From 8e22bfffb2baecd45331c95db8fb1ac886ae658d Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom Date: Thu, 12 Nov 2026 20:46:41 -0800 Subject: [PATCH 01/23] Update samples to create Foundry in resource group location --- .../00-basic/azuredeploy.json | 39 +- .../00-basic/main.bicep | 37 +- .../ai-gateway-tier/azuredeploy.json | 41 +- .../01-connections/ai-gateway-tier/main.bicep | 39 +- .../01-connections/connection-foundry.bicep | 6 +- .../01-connections/connection-foundry.json | 18 +- .../02-storage-speech-language/main.bicep | 37 +- .../03-custom-dns/azuredeploy.json | 39 +- .../03-custom-dns/main.bicep | 37 +- .../04-disable-local-auth/azuredeploy.json | 39 +- .../04-disable-local-auth/main.bicep | 37 +- .../10-private-network-basic/azuredeploy.json | 39 +- .../10-private-network-basic/main.bicep | 37 +- .../10-private-network-basic/main.json | 228 ++++++++- .../azuredeploy.json | 478 ++++++++++++++++-- .../11-private-network-basic-vnet/main.bicep | 48 +- .../11-private-network-basic-vnet/main.json | 478 ++++++++++++++++-- .../ai-account-identity.bicep | 3 +- .../azuredeploy.json | 93 ++-- .../main.bicep | 47 +- .../azuredeploy.json | 63 ++- .../assets/bicep/account.bicep | 3 +- .../main.bicep | 47 +- .../azuredeploy.json | 79 ++- .../ai-gateway-tier-private/azuredeploy.json | 9 +- .../ai-gateway-tier-private/main.bicep | 13 +- .../ai-gateway-tier-private/main.json | 12 +- .../main.bicep | 47 +- .../azuredeploy.json | 47 +- .../main.bicep | 47 +- .../azuredeploy.json | 45 +- .../18-managed-virtual-network/main.bicep | 37 +- .../azuredeploy.json | 52 +- .../19-private-network-agent-tools/main.bicep | 48 +- .../azuredeploy.json | 39 +- .../20-user-assigned-identity/main.bicep | 37 +- .../20-user-assigned-identity/main.json | 39 +- .../25-entraid-passthrough/main.bicep | 37 +- .../30-customer-managed-keys/azuredeploy.json | 37 +- .../30-customer-managed-keys/main.bicep | 37 +- .../azuredeploy.json | 41 +- .../main.bicep | 37 +- .../main.bicep | 37 +- .../40-basic-agent-setup/azuredeploy.json | 33 +- .../40-basic-agent-setup/main.bicep | 33 +- .../41-standard-agent-setup/azuredeploy.json | 33 +- .../41-standard-agent-setup/main.bicep | 33 +- .../azuredeploy.json | 33 +- .../main.bicep | 33 +- .../azuredeploy.json | 33 +- .../main.bicep | 33 +- .../45-basic-agent-bing/azuredeploy.json | 39 +- .../45-basic-agent-bing/main.bicep | 37 +- .../azuredeploy.json | 43 +- .../48-bring-own-model-private-ca/main.bicep | 39 +- .../48-bring-own-model-private-ca/main.json | 43 +- .../00-basic-azurerm/code/example.tfvars | 2 +- .../00-basic-azurerm/code/main.tf | 6 +- .../00-basic-azurerm/code/variables.tf | 37 ++ .../00-basic/code/example.tfvars | 2 +- .../00-basic/code/main.tf | 8 +- .../00-basic/code/variables.tf | 37 ++ .../code/example.tfvars | 2 +- .../02-storage-speech-language/code/main.tf | 2 +- .../code/variables.tf | 13 +- .../03-custom-dns/code/example.tfvars | 2 +- .../03-custom-dns/code/main.tf | 2 +- .../03-custom-dns/code/variables.tf | 13 +- .../04-disable-local-auth/code/example.tfvars | 2 +- .../04-disable-local-auth/code/main.tf | 2 +- .../04-disable-local-auth/code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../10-private-network-basic/code/main.tf | 2 +- .../code/variables.tf | 13 +- .../code/main.tf | 2 +- .../code/variables.tf | 11 + .../code/main.tf | 2 +- .../code/variables.tf | 11 + .../code/main.tf | 9 +- .../code/variables.tf | 11 + .../code/example.tfvars | 2 +- .../code/main.tf | 2 +- .../code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../code/main.tf | 2 +- .../code/variables.tf | 13 +- .../terraform.tfvars.example | 2 +- .../18-managed-virtual-network/variables.tf | 11 + .../code/data.tf | 11 +- .../code/locals.tf | 11 +- .../code/main.tf | 4 +- .../code/variables.tf | 11 + .../code/example.tfvars | 2 +- .../20-user-assigned-identity/code/main.tf | 2 +- .../code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../25-entraid-passthrough/code/main.tf | 2 +- .../25-entraid-passthrough/code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../30-customer-managed-keys/code/main.tf | 6 +- .../code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../code/main.tf | 2 +- .../code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../code/main.tf | 2 +- .../code/variables.tf | 13 +- .../code/example.tfvars | 2 +- .../41-standard-agent-setup/code/main.tf | 2 +- .../41-standard-agent-setup/code/variables.tf | 13 +- .../45-basic-agent-bing/code/example.tfvars | 2 +- .../45-basic-agent-bing/code/main.tf | 2 +- .../45-basic-agent-bing/code/variables.tf | 13 +- .../code/development-foundry.tf | 2 +- .../code/example.tfvars | 4 +- .../code/platform-foundry.tf | 2 +- .../code/variables.tf | 13 +- .../01-hub-base/variables.tf | 11 + .../02-spoke-base/variables.tf | 11 + .../04-hub-workload/foundry-account.tf | 6 +- .../foundry-account.tf | 6 +- .../code/foundry-agent.tf | 2 +- .../code/foundry-model.tf | 2 +- .../code/terraform.tfvars.example | 2 +- .../code/variables.tf | 17 +- 125 files changed, 3049 insertions(+), 617 deletions(-) diff --git a/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json index 5edf30433..89817a262 100644 --- a/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "4687470877814835157" + "templateHash": "848823311706516415" } }, "parameters": { @@ -19,7 +19,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus2" + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ] } }, "resources": [ @@ -27,7 +60,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep b/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep index cf0df6f16..4684c8bad 100644 --- a/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep @@ -1,13 +1,46 @@ param aiFoundryName string = 'foundry-name' param aiProjectName string = '${aiFoundryName}-proj' -param location string = 'eastus2' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) /* An AI Foundry resources is a variant of a CognitiveServices/account resource type */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json index f63c151b4..dc34bad02 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "2257742962386746331" + "templateHash": "10260295346214143128" } }, "parameters": { @@ -40,9 +40,42 @@ }, "location": { "type": "string", - "defaultValue": "eastus2", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { - "description": "Region for the account, project, and model. Defaults to eastus2; can differ from gatewayLocation (e.g. a CI region)." + "description": "Region for the account, project, and model. Defaults to the resource-group location and can differ from gatewayLocation." } }, "gatewayLocation": { @@ -131,7 +164,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep index d0fae8dc8..f52f41348 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep @@ -50,8 +50,41 @@ param projectDescription string = 'AI Gateway tier hub: owns the model behind th @description('Hub project display name.') param projectDisplayName string = 'AI Gateway tier hub' -@description('Region for the account, project, and model. Defaults to eastus2; can differ from gatewayLocation (e.g. a CI region).') -param location string = 'eastus2' +@description('Region for the account, project, and model. Defaults to the resource-group location and can differ from gatewayLocation.') +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @allowed([ 'eastus2' @@ -105,7 +138,7 @@ var accountName = toLower('${aiServicesName}${uniqueSuffix}') // =========================================================================== resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep index 944a446e7..df8a914a0 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep +++ b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep @@ -12,18 +12,16 @@ az deployment group create \ Optional parameters: - connectedResourceName: Name of the target Azure AI Foundry resource (default: foundry-{aiFoundryName}) -- location: Azure region (default: westus) - newOrExisting: Whether to create new or use existing Azure AI Foundry resource (default: new) - authType: Authentication type - ApiKey or AAD (default: ApiKey) - isSharedToAll: Share connection with all users (default: true) Example with all parameters: -az deployment group create --name AzDeploy --resource-group myResourceGroup --template-file connection-foundry.bicep --parameters aiFoundryName=myFoundry connectedResourceName=myTargetFoundry location=eastus newOrExisting=existing authType=AAD isSharedToAll=false +az deployment group create --name AzDeploy --resource-group myResourceGroup --template-file connection-foundry.bicep --parameters aiFoundryName=myFoundry connectedResourceName=myTargetFoundry newOrExisting=existing authType=AAD isSharedToAll=false */ param aiFoundryName string = '' param connectedResourceName string = 'foundry-${aiFoundryName}' -param location string = 'westus' // Whether to create a new Azure AI Foundry resource @allowed([ @@ -56,7 +54,7 @@ resource existingFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-previe // Conditionally creates a new target Azure AI Foundry resource resource newFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if (newOrExisting == 'new') { name: connectedResourceName - location: location + location: resourceGroup().location kind: 'AIServices' sku: { name: 'S0' diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json index ccee68748..02de93033 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json +++ b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.37.4.10188", - "templateHash": "8574372845632247592" + "templateHash": "14155744296600836147" } }, "parameters": { @@ -17,10 +17,6 @@ "type": "string", "defaultValue": "[format('foundry-{0}', parameters('aiFoundryName'))]" }, - "location": { - "type": "string", - "defaultValue": "westus" - }, "newOrExisting": { "type": "string", "defaultValue": "new", @@ -48,7 +44,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[parameters('connectedResourceName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "kind": "AIServices", "sku": { "name": "S0" @@ -61,14 +57,14 @@ "name": "[format('{0}/{1}', parameters('aiFoundryName'), format('{0}-foundry', parameters('aiFoundryName')))]", "properties": { "category": "AIServices", - "target": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').endpoint]", + "target": "[if(equals(parameters('newOrExisting'), 'new'), reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').endpoint, reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').endpoint)]", "authType": "[parameters('authType')]", "isSharedToAll": "[parameters('isSharedToAll')]", - "credentials": "[if(equals(parameters('authType'), 'ApiKey'), createObject('key', listKeys(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').key1), createObject())]", + "credentials": "[if(equals(parameters('authType'), 'ApiKey'), createObject('key', if(equals(parameters('newOrExisting'), 'new'), listKeys(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').key1, listKeys(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview').key1)), createObject())]", "metadata": { "ApiType": "Azure", - "ResourceId": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName'))]", - "location": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview', 'full').location]" + "ResourceId": "[if(equals(parameters('newOrExisting'), 'new'), resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')))]", + "location": "[if(equals(parameters('newOrExisting'), 'new'), reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview', 'full').location, reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('connectedResourceName')), '2025-04-01-preview', 'full').location)]" } }, "dependsOn": [ @@ -76,4 +72,4 @@ ] } ] -} +} \ No newline at end of file diff --git a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep index 874f959a0..bf33fe8f6 100644 --- a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep @@ -6,7 +6,40 @@ param aiFoundryName string @description('Location for the resource') -param location string = resourceGroup().location +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) // Storage Account Parameters @description('Azure storage resource ID (leave empty to create a new storage account)') @@ -88,7 +121,7 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-01-01' = if (!us // ==================================================================== resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = { name: aiFoundryName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json index 672e78928..b1e31b43b 100644 --- a/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "17555450976668837106" + "templateHash": "119560110974746177" } }, "parameters": { @@ -23,7 +23,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus2" + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ] } }, "resources": [ @@ -31,7 +64,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep b/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep index 1a8590bfe..a8df065d4 100644 --- a/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep @@ -1,14 +1,47 @@ param aiFoundryName string = 'foundry-name' param customDNSName string = 'foundry-alt-custom-dns' param aiProjectName string = '${aiFoundryName}-proj' -param location string = 'eastus2' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) /* An AI Foundry resources is a variant of a CognitiveServices/account resource type */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json index d2cee29a4..3e3129a5d 100644 --- a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "6087024663439753870" + "templateHash": "10340953561333823360" } }, "parameters": { @@ -19,7 +19,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus2" + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ] } }, "resources": [ @@ -27,7 +60,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep index 94693a1e8..04ceabf0d 100644 --- a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep @@ -1,13 +1,46 @@ param aiFoundryName string = 'foundry-disable-localauth' param aiProjectName string = '${aiFoundryName}-proj' -param location string = 'eastus2' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) /* An AI Foundry resources is a variant of a CognitiveServices/account resource type */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json index b8716c128..00547e0a2 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "964975521955820946" + "templateHash": "8690465677147923595" } }, "parameters": { @@ -18,7 +18,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources." } @@ -50,7 +83,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep index b3d24469c..6e32ee677 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep @@ -9,7 +9,40 @@ param aiFoundryName string = 'foundrypnadisabled-${uniqueString(resourceGroup().id)}' @description('Location for all resources.') -param location string = 'eastus' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name of the first project') param defaultProjectName string = '${aiFoundryName}-proj' @@ -25,7 +58,7 @@ param peSubnetName string = 'pe-subnet' */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json index f27643520..59467f257 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json @@ -5,20 +5,53 @@ "_generator": { "name": "bicep", "version": "0.35.1.17967", - "templateHash": "514902755770759577" + "templateHash": "2708602652802231157" } }, "parameters": { "aiFoundryName": { "type": "string", - "defaultValue": "foundrypnadisabled", + "defaultValue": "[format('foundrypnadisabled-{0}', uniqueString(resourceGroup().id))]", "metadata": { - "description": "That name is the name of our application. It has to be unique. Type a name followed by your resource group name. (-)" + "description": "Name for the AI Foundry account. Used as customSubDomainName (globally unique). Default appends a per-RG suffix to avoid collisions." } }, "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources." } @@ -30,21 +63,27 @@ "description": "Name of the first project" } }, - "defaultProjectDisplayName": { + "vnetName": { "type": "string", - "defaultValue": "Project" + "defaultValue": "private-vnet", + "metadata": { + "description": "Name of the virtual network" + } }, - "defaultProjectDescription": { + "peSubnetName": { "type": "string", - "defaultValue": "Describe what your project is about." + "defaultValue": "pe-subnet", + "metadata": { + "description": "Name of the private endpoint subnet" + } } }, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", - "apiVersion": "2025-04-01-preview", + "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, @@ -59,6 +98,167 @@ "disableLocalAuth": false } }, + { + "type": "Microsoft.Network/virtualNetworks", + "apiVersion": "2024-05-01", + "name": "[parameters('vnetName')]", + "location": "[parameters('location')]", + "properties": { + "addressSpace": { + "addressPrefixes": [ + "192.168.0.0/16" + ] + }, + "subnets": [ + { + "name": "[parameters('peSubnetName')]", + "properties": { + "addressPrefix": "192.168.0.0/24" + } + } + ] + } + }, + { + "type": "Microsoft.Network/virtualNetworks/subnets", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('vnetName'), parameters('peSubnetName'))]", + "properties": { + "addressPrefix": "192.168.0.0/24" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[format('{0}-private-endpoint', parameters('aiFoundryName'))]", + "location": "[resourceGroup().location]", + "properties": { + "subnet": { + "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" + }, + "privateLinkServiceConnections": [ + { + "name": "[format('{0}-private-link-service-connection', parameters('aiFoundryName'))]", + "properties": { + "privateLinkServiceId": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]", + "groupIds": [ + "account" + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]", + "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('aiFoundryName'), parameters('defaultProjectName'))]", + "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" + ] + }, + { + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2020-06-01", + "name": "privatelink.services.ai.azure.com", + "location": "global" + }, + { + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2020-06-01", + "name": "privatelink.openai.azure.com", + "location": "global" + }, + { + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2020-06-01", + "name": "privatelink.cognitiveservices.azure.com", + "location": "global" + }, + { + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/{1}', 'privatelink.services.ai.azure.com', 'aiServices-link')]", + "location": "global", + "properties": { + "virtualNetwork": { + "id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.services.ai.azure.com')]", + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + ] + }, + { + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/{1}', 'privatelink.openai.azure.com', 'aiServicesOpenAI-link')]", + "location": "global", + "properties": { + "virtualNetwork": { + "id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.openai.azure.com')]", + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + ] + }, + { + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/{1}', 'privatelink.cognitiveservices.azure.com', 'aiServicesCognitiveServices-link')]", + "location": "global", + "properties": { + "virtualNetwork": { + "id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.cognitiveservices.azure.com')]", + "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', format('{0}-private-endpoint', parameters('aiFoundryName')), format('{0}-dns-group', parameters('aiFoundryName')))]", + "properties": { + "privateDnsZoneConfigs": [ + { + "name": "[format('{0}-dns-aiserv-config', parameters('aiFoundryName'))]", + "properties": { + "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.services.ai.azure.com')]" + } + }, + { + "name": "[format('{0}-dns-openai-config', parameters('aiFoundryName'))]", + "properties": { + "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.openai.azure.com')]" + } + }, + { + "name": "[format('{0}-dns-cogserv-config', parameters('aiFoundryName'))]", + "properties": { + "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.cognitiveservices.azure.com')]" + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-private-endpoint', parameters('aiFoundryName')))]", + "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', 'privatelink.openai.azure.com', 'aiServicesOpenAI-link')]", + "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', 'privatelink.services.ai.azure.com', 'aiServices-link')]", + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.services.ai.azure.com')]", + "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', 'privatelink.cognitiveservices.azure.com', 'aiServicesCognitiveServices-link')]", + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.cognitiveservices.azure.com')]", + "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.openai.azure.com')]" + ] + }, { "type": "Microsoft.CognitiveServices/accounts/deployments", "apiVersion": "2024-10-01", @@ -80,17 +280,13 @@ }, { "type": "Microsoft.CognitiveServices/accounts/projects", - "apiVersion": "2025-04-01-preview", + "apiVersion": "2025-06-01", "name": "[format('{0}/{1}', parameters('aiFoundryName'), parameters('defaultProjectName'))]", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, - "properties": { - "displayName": "[parameters('defaultProjectDisplayName')]", - "description": "[parameters('defaultProjectDescription')]", - "isDefault": true - }, + "properties": {}, "dependsOn": [ "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]" ] diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/azuredeploy.json index 49a8bfbf9..072081d49 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/azuredeploy.json @@ -5,38 +5,45 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "6646415653041588209" + "templateHash": "2110640118335440235" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", - "canadacentral", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -187,6 +194,18 @@ "description": "Object mapping DNS zone names to their resource group, or empty string to indicate creation" } }, + "existingMonitorDnsZones": { + "type": "object", + "defaultValue": { + "privatelink.monitor.azure.com": "", + "privatelink.oms.opinsights.azure.com": "", + "privatelink.ods.opinsights.azure.com": "", + "privatelink.agentsvc.azure-automation.net": "" + }, + "metadata": { + "description": "Object mapping Azure Monitor private DNS zone names to the resource group of an existing zone, or empty string to create it. Use to bring your own centralized Private DNS Zones (e.g. an Azure Landing Zone connectivity subscription) for agent tracing." + } + }, "dnsZoneNames": { "type": "array", "defaultValue": [ @@ -248,9 +267,6 @@ }, "mode": "Incremental", "parameters": { - "location": { - "value": "[parameters('location')]" - }, "vnetName": { "value": "[variables('trimVnetName')]" }, @@ -277,6 +293,9 @@ }, "existingVnetSubscriptionId": { "value": "[variables('vnetSubscriptionId')]" + }, + "location": { + "value": "[parameters('location')]" } }, "template": { @@ -892,9 +911,6 @@ "accountName": { "value": "[variables('accountName')]" }, - "location": { - "value": "[parameters('location')]" - }, "modelName": { "value": "[parameters('modelName')]" }, @@ -921,16 +937,13 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "8297556890969361359" + "templateHash": "14793506092119170443" } }, "parameters": { "accountName": { "type": "string" }, - "location": { - "type": "string" - }, "modelName": { "type": "string" }, @@ -959,7 +972,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[parameters('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, @@ -1519,6 +1532,411 @@ "[resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix')))]" ] }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('app-insights-{0}-deployment', variables('uniqueSuffix'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "suffix": { + "value": "[variables('uniqueSuffix')]" + }, + "aiAccountName": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix'))), '2025-04-01').outputs.accountName.value]" + }, + "disablePublicIngestion": { + "value": true + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.44.1.10279", + "templateHash": "10644740557362119851" + } + }, + "parameters": { + "location": { + "type": "string", + "metadata": { + "description": "Azure region for the tracing resources." + } + }, + "suffix": { + "type": "string", + "metadata": { + "description": "Suffix for unique resource names (the template uniqueSuffix)." + } + }, + "aiAccountName": { + "type": "string", + "metadata": { + "description": "Name of the Foundry (AI Services) account to connect Application Insights to." + } + }, + "disablePublicIngestion": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, disable public ingestion (reach Application Insights privately via AMPLS). Set false for public templates." + } + }, + "logAnalyticsName": { + "type": "string", + "defaultValue": "[format('law-tracing-{0}', parameters('suffix'))]", + "metadata": { + "description": "Name of the Log Analytics workspace to create." + } + }, + "appInsightsName": { + "type": "string", + "defaultValue": "[format('appi-tracing-{0}', parameters('suffix'))]", + "metadata": { + "description": "Name of the Application Insights component to create." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2023-09-01", + "name": "[parameters('logAnalyticsName')]", + "location": "[parameters('location')]", + "properties": { + "sku": { + "name": "PerGB2018" + }, + "retentionInDays": 30 + } + }, + { + "type": "Microsoft.Insights/components", + "apiVersion": "2020-02-02", + "name": "[parameters('appInsightsName')]", + "location": "[parameters('location')]", + "kind": "web", + "properties": { + "Application_Type": "web", + "WorkspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]", + "publicNetworkAccessForIngestion": "[if(parameters('disablePublicIngestion'), 'Disabled', 'Enabled')]", + "publicNetworkAccessForQuery": "Enabled" + }, + "dependsOn": [ + "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]" + ] + }, + { + "type": "Microsoft.CognitiveServices/accounts/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('aiAccountName'), format('{0}-appinsights', parameters('aiAccountName')))]", + "properties": { + "category": "AppInsights", + "target": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]", + "authType": "ApiKey", + "isSharedToAll": true, + "credentials": { + "key": "[reference(resourceId('Microsoft.Insights/components', parameters('appInsightsName')), '2020-02-02').ConnectionString]" + }, + "metadata": { + "ApiType": "Azure", + "ResourceId": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + ] + } + ], + "outputs": { + "appInsightsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Application Insights component." + }, + "value": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + }, + "appInsightsAppId": { + "type": "string", + "metadata": { + "description": "Application ID of the Application Insights component (for trace queries)." + }, + "value": "[reference(resourceId('Microsoft.Insights/components', parameters('appInsightsName')), '2020-02-02').AppId]" + }, + "logAnalyticsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Log Analytics workspace backing Application Insights." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]" + } + } + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix')))]" + ] + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('monitor-pls-{0}-deployment', variables('uniqueSuffix'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "suffix": { + "value": "[variables('uniqueSuffix')]" + }, + "appInsightsId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.appInsightsId.value]" + }, + "logAnalyticsId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.logAnalyticsId.value]" + }, + "vnetId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix'))), '2025-04-01').outputs.virtualNetworkId.value]" + }, + "peSubnetId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix'))), '2025-04-01').outputs.peSubnetId.value]" + }, + "existingDnsZones": { + "value": "[parameters('existingMonitorDnsZones')]" + }, + "dnsZonesSubscriptionId": { + "value": "[variables('resolvedDnsZonesSubscriptionId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.44.1.10279", + "templateHash": "14873214704014114490" + } + }, + "parameters": { + "location": { + "type": "string", + "metadata": { + "description": "Azure region for the private endpoint." + } + }, + "suffix": { + "type": "string", + "metadata": { + "description": "Suffix for unique resource names (the template uniqueSuffix)." + } + }, + "appInsightsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Application Insights component to scope into the AMPLS." + } + }, + "logAnalyticsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Log Analytics workspace to scope into the AMPLS." + } + }, + "vnetId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Virtual Network." + } + }, + "peSubnetId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Private Endpoint subnet." + } + }, + "existingDnsZones": { + "type": "object", + "defaultValue": { + "privatelink.monitor.azure.com": "", + "privatelink.oms.opinsights.azure.com": "", + "privatelink.ods.opinsights.azure.com": "", + "privatelink.agentsvc.azure-automation.net": "" + }, + "metadata": { + "description": "Map of Azure Monitor private DNS zone name to the resource group of an existing zone. An empty string for a zone means the module creates and links it in this resource group; a non-empty resource group means bring your own existing (e.g. centralized Azure Landing Zone) zone, which is referenced instead of recreated." + } + }, + "dnsZonesSubscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Subscription ID where existing Azure Monitor private DNS zones are located. Defaults to the current subscription." + } + } + }, + "variables": { + "copy": [ + { + "name": "monitorDnsZoneIds", + "count": "[length(variables('monitorDnsZoneNames'))]", + "input": "[if(empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]]), resourceId('Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('dnsZonesSubscriptionId'), parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]]), 'Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]))]" + } + ], + "monitorDnsZoneNames": [ + "privatelink.monitor.azure.com", + "privatelink.oms.opinsights.azure.com", + "privatelink.ods.opinsights.azure.com", + "privatelink.agentsvc.azure-automation.net" + ] + }, + "resources": [ + { + "type": "microsoft.insights/privateLinkScopes", + "apiVersion": "2021-07-01-preview", + "name": "[format('ampls-tracing-{0}', parameters('suffix'))]", + "location": "global", + "properties": { + "accessModeSettings": { + "ingestionAccessMode": "PrivateOnly", + "queryAccessMode": "Open" + } + } + }, + { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}', parameters('suffix')), 'appinsights-scoped')]", + "properties": { + "linkedResourceId": "[parameters('appInsightsId')]" + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + ] + }, + { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}', parameters('suffix')), 'law-scoped')]", + "properties": { + "linkedResourceId": "[parameters('logAnalyticsId')]" + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + ] + }, + { + "copy": { + "name": "monitorDnsZones", + "count": "[length(variables('monitorDnsZoneNames'))]" + }, + "condition": "[empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex()]])]", + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2020-06-01", + "name": "[variables('monitorDnsZoneNames')[copyIndex()]]", + "location": "global" + }, + { + "copy": { + "name": "monitorDnsZoneLinks", + "count": "[length(variables('monitorDnsZoneNames'))]" + }, + "condition": "[empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex()]])]", + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/{1}', variables('monitorDnsZoneNames')[copyIndex()], format('{0}-link', replace(variables('monitorDnsZoneNames')[copyIndex()], '.', '-')))]", + "location": "global", + "properties": { + "virtualNetwork": { + "id": "[parameters('vnetId')]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex()])]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[format('ampls-tracing-{0}-pe', parameters('suffix'))]", + "location": "[parameters('location')]", + "properties": { + "subnet": { + "id": "[parameters('peSubnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "ampls-connection", + "properties": { + "privateLinkServiceId": "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]", + "groupIds": [ + "azuremonitor" + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]", + "[resourceId('Microsoft.Insights/privateLinkScopes/scopedResources', format('ampls-tracing-{0}', parameters('suffix')), 'appinsights-scoped')]", + "[resourceId('Microsoft.Insights/privateLinkScopes/scopedResources', format('ampls-tracing-{0}', parameters('suffix')), 'law-scoped')]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}-pe', parameters('suffix')), 'ampls-dns')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(variables('monitorDnsZoneNames'))]", + "input": { + "name": "[replace(variables('monitorDnsZoneNames')[copyIndex('privateDnsZoneConfigs')], '.', '-')]", + "properties": { + "privateDnsZoneId": "[variables('monitorDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateEndpoints', format('ampls-tracing-{0}-pe', parameters('suffix')))]", + "monitorDnsZoneLinks" + ] + } + ], + "outputs": { + "amplsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Azure Monitor Private Link Scope." + }, + "value": "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + } + } + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix')))]", + "[resourceId('Microsoft.Resources/deployments', format('{0}-private-endpoint', variables('uniqueSuffix')))]", + "[resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix')))]" + ] + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2025-04-01", diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep index 4c32c16b3..a80cbb6d8 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep @@ -15,34 +15,39 @@ are used instead. */ @description('Location for all resources.') @allowed([ - 'westus' + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' - 'canadacentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiServices string = 'aiservices' @@ -157,7 +162,6 @@ var resolvedDnsZonesSubscriptionId = empty(dnsZonesSubscriptionId) ? subscriptio module vnet 'modules-network-secured/network-agent-vnet.bicep' = { name: 'vnet-${trimVnetName}-${uniqueSuffix}-deployment' params: { - location: location vnetName: trimVnetName useExistingVnet: existingVnetPassedIn existingVnetResourceGroupName: vnetResourceGroupName @@ -167,6 +171,7 @@ module vnet 'modules-network-secured/network-agent-vnet.bicep' = { agentSubnetPrefix: agentSubnetPrefix peSubnetPrefix: peSubnetPrefix existingVnetSubscriptionId: vnetSubscriptionId + location: location } } @@ -180,7 +185,6 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { name: '${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json index 479d4be92..e4e59e387 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json @@ -5,38 +5,45 @@ "_generator": { "name": "bicep", "version": "0.43.8.12551", - "templateHash": "1439992269587931650" + "templateHash": "12427516200668814305" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", - "canadacentral", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -187,6 +194,18 @@ "description": "Object mapping DNS zone names to their resource group, or empty string to indicate creation" } }, + "existingMonitorDnsZones": { + "type": "object", + "defaultValue": { + "privatelink.monitor.azure.com": "", + "privatelink.oms.opinsights.azure.com": "", + "privatelink.ods.opinsights.azure.com": "", + "privatelink.agentsvc.azure-automation.net": "" + }, + "metadata": { + "description": "Object mapping Azure Monitor private DNS zone names to the resource group of an existing zone, or empty string to create it. Use to bring your own centralized Private DNS Zones (e.g. an Azure Landing Zone connectivity subscription) for agent tracing." + } + }, "dnsZoneNames": { "type": "array", "defaultValue": [ @@ -248,9 +267,6 @@ }, "mode": "Incremental", "parameters": { - "location": { - "value": "[parameters('location')]" - }, "vnetName": { "value": "[variables('trimVnetName')]" }, @@ -277,6 +293,9 @@ }, "existingVnetSubscriptionId": { "value": "[variables('vnetSubscriptionId')]" + }, + "location": { + "value": "[parameters('location')]" } }, "template": { @@ -892,9 +911,6 @@ "accountName": { "value": "[variables('accountName')]" }, - "location": { - "value": "[parameters('location')]" - }, "modelName": { "value": "[parameters('modelName')]" }, @@ -921,16 +937,13 @@ "_generator": { "name": "bicep", "version": "0.43.8.12551", - "templateHash": "1400943577065869287" + "templateHash": "10415108349705677394" } }, "parameters": { "accountName": { "type": "string" }, - "location": { - "type": "string" - }, "modelName": { "type": "string" }, @@ -959,7 +972,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[parameters('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, @@ -1519,6 +1532,411 @@ "[resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix')))]" ] }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('app-insights-{0}-deployment', variables('uniqueSuffix'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "suffix": { + "value": "[variables('uniqueSuffix')]" + }, + "aiAccountName": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix'))), '2025-04-01').outputs.accountName.value]" + }, + "disablePublicIngestion": { + "value": true + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.43.8.12551", + "templateHash": "14903937882087600421" + } + }, + "parameters": { + "location": { + "type": "string", + "metadata": { + "description": "Azure region for the tracing resources." + } + }, + "suffix": { + "type": "string", + "metadata": { + "description": "Suffix for unique resource names (the template uniqueSuffix)." + } + }, + "aiAccountName": { + "type": "string", + "metadata": { + "description": "Name of the Foundry (AI Services) account to connect Application Insights to." + } + }, + "disablePublicIngestion": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, disable public ingestion (reach Application Insights privately via AMPLS). Set false for public templates." + } + }, + "logAnalyticsName": { + "type": "string", + "defaultValue": "[format('law-tracing-{0}', parameters('suffix'))]", + "metadata": { + "description": "Name of the Log Analytics workspace to create." + } + }, + "appInsightsName": { + "type": "string", + "defaultValue": "[format('appi-tracing-{0}', parameters('suffix'))]", + "metadata": { + "description": "Name of the Application Insights component to create." + } + } + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2023-09-01", + "name": "[parameters('logAnalyticsName')]", + "location": "[parameters('location')]", + "properties": { + "sku": { + "name": "PerGB2018" + }, + "retentionInDays": 30 + } + }, + { + "type": "Microsoft.Insights/components", + "apiVersion": "2020-02-02", + "name": "[parameters('appInsightsName')]", + "location": "[parameters('location')]", + "kind": "web", + "properties": { + "Application_Type": "web", + "WorkspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]", + "publicNetworkAccessForIngestion": "[if(parameters('disablePublicIngestion'), 'Disabled', 'Enabled')]", + "publicNetworkAccessForQuery": "Enabled" + }, + "dependsOn": [ + "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]" + ] + }, + { + "type": "Microsoft.CognitiveServices/accounts/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('aiAccountName'), format('{0}-appinsights', parameters('aiAccountName')))]", + "properties": { + "category": "AppInsights", + "target": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]", + "authType": "ApiKey", + "isSharedToAll": true, + "credentials": { + "key": "[reference(resourceId('Microsoft.Insights/components', parameters('appInsightsName')), '2020-02-02').ConnectionString]" + }, + "metadata": { + "ApiType": "Azure", + "ResourceId": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + ] + } + ], + "outputs": { + "appInsightsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Application Insights component." + }, + "value": "[resourceId('Microsoft.Insights/components', parameters('appInsightsName'))]" + }, + "appInsightsAppId": { + "type": "string", + "metadata": { + "description": "Application ID of the Application Insights component (for trace queries)." + }, + "value": "[reference(resourceId('Microsoft.Insights/components', parameters('appInsightsName')), '2020-02-02').AppId]" + }, + "logAnalyticsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Log Analytics workspace backing Application Insights." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]" + } + } + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix')))]" + ] + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('monitor-pls-{0}-deployment', variables('uniqueSuffix'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "suffix": { + "value": "[variables('uniqueSuffix')]" + }, + "appInsightsId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.appInsightsId.value]" + }, + "logAnalyticsId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.logAnalyticsId.value]" + }, + "vnetId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix'))), '2025-04-01').outputs.virtualNetworkId.value]" + }, + "peSubnetId": { + "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix'))), '2025-04-01').outputs.peSubnetId.value]" + }, + "existingDnsZones": { + "value": "[parameters('existingMonitorDnsZones')]" + }, + "dnsZonesSubscriptionId": { + "value": "[variables('resolvedDnsZonesSubscriptionId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.43.8.12551", + "templateHash": "2109142665252549485" + } + }, + "parameters": { + "location": { + "type": "string", + "metadata": { + "description": "Azure region for the private endpoint." + } + }, + "suffix": { + "type": "string", + "metadata": { + "description": "Suffix for unique resource names (the template uniqueSuffix)." + } + }, + "appInsightsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Application Insights component to scope into the AMPLS." + } + }, + "logAnalyticsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Log Analytics workspace to scope into the AMPLS." + } + }, + "vnetId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Virtual Network." + } + }, + "peSubnetId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Private Endpoint subnet." + } + }, + "existingDnsZones": { + "type": "object", + "defaultValue": { + "privatelink.monitor.azure.com": "", + "privatelink.oms.opinsights.azure.com": "", + "privatelink.ods.opinsights.azure.com": "", + "privatelink.agentsvc.azure-automation.net": "" + }, + "metadata": { + "description": "Map of Azure Monitor private DNS zone name to the resource group of an existing zone. An empty string for a zone means the module creates and links it in this resource group; a non-empty resource group means bring your own existing (e.g. centralized Azure Landing Zone) zone, which is referenced instead of recreated." + } + }, + "dnsZonesSubscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Subscription ID where existing Azure Monitor private DNS zones are located. Defaults to the current subscription." + } + } + }, + "variables": { + "copy": [ + { + "name": "monitorDnsZoneIds", + "count": "[length(variables('monitorDnsZoneNames'))]", + "input": "[if(empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]]), resourceId('Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('dnsZonesSubscriptionId'), parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]]), 'Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex('monitorDnsZoneIds')]))]" + } + ], + "monitorDnsZoneNames": [ + "privatelink.monitor.azure.com", + "privatelink.oms.opinsights.azure.com", + "privatelink.ods.opinsights.azure.com", + "privatelink.agentsvc.azure-automation.net" + ] + }, + "resources": [ + { + "type": "microsoft.insights/privateLinkScopes", + "apiVersion": "2021-07-01-preview", + "name": "[format('ampls-tracing-{0}', parameters('suffix'))]", + "location": "global", + "properties": { + "accessModeSettings": { + "ingestionAccessMode": "PrivateOnly", + "queryAccessMode": "Open" + } + } + }, + { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}', parameters('suffix')), 'appinsights-scoped')]", + "properties": { + "linkedResourceId": "[parameters('appInsightsId')]" + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + ] + }, + { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}', parameters('suffix')), 'law-scoped')]", + "properties": { + "linkedResourceId": "[parameters('logAnalyticsId')]" + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + ] + }, + { + "copy": { + "name": "monitorDnsZones", + "count": "[length(variables('monitorDnsZoneNames'))]" + }, + "condition": "[empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex()]])]", + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2020-06-01", + "name": "[variables('monitorDnsZoneNames')[copyIndex()]]", + "location": "global" + }, + { + "copy": { + "name": "monitorDnsZoneLinks", + "count": "[length(variables('monitorDnsZoneNames'))]" + }, + "condition": "[empty(parameters('existingDnsZones')[variables('monitorDnsZoneNames')[copyIndex()]])]", + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/{1}', variables('monitorDnsZoneNames')[copyIndex()], format('{0}-link', replace(variables('monitorDnsZoneNames')[copyIndex()], '.', '-')))]", + "location": "global", + "properties": { + "virtualNetwork": { + "id": "[parameters('vnetId')]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', variables('monitorDnsZoneNames')[copyIndex()])]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[format('ampls-tracing-{0}-pe', parameters('suffix'))]", + "location": "[parameters('location')]", + "properties": { + "subnet": { + "id": "[parameters('peSubnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "ampls-connection", + "properties": { + "privateLinkServiceId": "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]", + "groupIds": [ + "azuremonitor" + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]", + "[resourceId('Microsoft.Insights/privateLinkScopes/scopedResources', format('ampls-tracing-{0}', parameters('suffix')), 'appinsights-scoped')]", + "[resourceId('Microsoft.Insights/privateLinkScopes/scopedResources', format('ampls-tracing-{0}', parameters('suffix')), 'law-scoped')]" + ] + }, + { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', format('ampls-tracing-{0}-pe', parameters('suffix')), 'ampls-dns')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(variables('monitorDnsZoneNames'))]", + "input": { + "name": "[replace(variables('monitorDnsZoneNames')[copyIndex('privateDnsZoneConfigs')], '.', '-')]", + "properties": { + "privateDnsZoneId": "[variables('monitorDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateEndpoints', format('ampls-tracing-{0}-pe', parameters('suffix')))]", + "monitorDnsZoneLinks" + ] + } + ], + "outputs": { + "amplsId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Azure Monitor Private Link Scope." + }, + "value": "[resourceId('microsoft.insights/privateLinkScopes', format('ampls-tracing-{0}', parameters('suffix')))]" + } + } + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', format('app-insights-{0}-deployment', variables('uniqueSuffix')))]", + "[resourceId('Microsoft.Resources/deployments', format('{0}-private-endpoint', variables('uniqueSuffix')))]", + "[resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix')))]" + ] + }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2025-04-01", diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep index 47f72a3be..0fb44396c 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep @@ -1,5 +1,4 @@ param accountName string -param location string param modelName string param modelFormat string param modelVersion string @@ -11,7 +10,7 @@ param networkInjection string = 'true' #disable-next-line BCP036 resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json index 996387de9..b760640ed 100644 --- a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json @@ -5,38 +5,45 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "9826847652772805128" + "templateHash": "10515888316830505882" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", - "canadacentral", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -175,6 +182,13 @@ "description": "Optional. When true, skip the model deployment. Recommended when reusing an existing account that already has the required model deployments." } }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. When true (default), disables API-key (local) authentication on the account. Set to false to enable API-key auth." + } + }, "enableContainerRegistry": { "type": "bool", "defaultValue": true, @@ -193,7 +207,7 @@ "type": "bool", "defaultValue": false, "metadata": { - "description": "Optional. Create the account-level capability host explicitly. Leave false for fresh deployments (platform auto-creates it via networkInjections). Set true only for a BYO account with no capability host, or to recreate after running deleteCapHost.sh." + "description": "Optional. Create the account-level capability host explicitly. Leave false for fresh deployments (the platform auto-creates {account}@aml_aiagentservice via networkInjections.scenario=agent). Set true only for a BYO account with no capability host, or to recreate after running deleteCapHost.sh." } }, "aiSearchResourceId": { @@ -308,7 +322,8 @@ "vnetResourceGroupName": "[if(variables('existingVnetPassedIn'), variables('vnetParts')[4], resourceGroup().name)]", "existingVnetName": "[if(variables('existingVnetPassedIn'), last(variables('vnetParts')), parameters('vnetName'))]", "trimVnetName": "[trim(variables('existingVnetName'))]", - "normalizedDnsZonesSubscriptionId": "[if(empty(parameters('dnsZonesSubscriptionId')), '', if(startsWith(toLower(parameters('dnsZonesSubscriptionId')), '/subscriptions/'), split(parameters('dnsZonesSubscriptionId'), '/')[2], parameters('dnsZonesSubscriptionId')))]", + "trimmedDnsZonesSubscriptionId": "[trim(parameters('dnsZonesSubscriptionId'))]", + "normalizedDnsZonesSubscriptionId": "[if(empty(variables('trimmedDnsZonesSubscriptionId')), '', if(startsWith(toLower(variables('trimmedDnsZonesSubscriptionId')), '/subscriptions/'), trim(split(variables('trimmedDnsZonesSubscriptionId'), '/')[2]), variables('trimmedDnsZonesSubscriptionId')))]", "resolvedDnsZonesSubscriptionId": "[if(empty(variables('normalizedDnsZonesSubscriptionId')), subscription().subscriptionId, variables('normalizedDnsZonesSubscriptionId'))]" }, "resources": [ @@ -989,7 +1004,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -1014,6 +1029,9 @@ }, "skipModelDeployment": { "value": "[parameters('skipModelDeployment')]" + }, + "disableLocalAuth": { + "value": "[parameters('disableLocalAuth')]" } }, "template": { @@ -1023,7 +1041,7 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "16030204193894738620" + "templateHash": "11271143357343719419" } }, "parameters": { @@ -1068,6 +1086,13 @@ "metadata": { "description": "Optional. When true, skip the model deployment. Recommended when reusing an existing account that already has the required model deployments." } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. When true (default), disables API-key (local) authentication on the account. Set to false to enable API-key auth." + } } }, "variables": { @@ -1102,7 +1127,7 @@ }, "publicNetworkAccess": "Disabled", "networkInjections": "[if(equals(parameters('networkInjection'), 'true'), createArray(createObject('scenario', 'agent', 'subnetArmId', parameters('agentSubnetId'), 'useMicrosoftManagedNetwork', false())), null())]", - "disableLocalAuth": false + "disableLocalAuth": "[parameters('disableLocalAuth')]" } }, { @@ -1634,6 +1659,9 @@ "aiAccountName": { "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix'))), '2025-04-01').outputs.accountName.value]" }, + "location": { + "value": "[parameters('location')]" + }, "aiSearchName": { "value": "[reference(resourceId('Microsoft.Resources/deployments', format('dependencies-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.aiSearchName.value]" }, @@ -1690,10 +1718,17 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "698272236681194869" + "templateHash": "8364807033973878778" } }, "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Azure region for the private endpoints. Defaults to the resource group location for backward compatibility; pass the deployment location so private endpoints are co-located with their target resources when the resource group is in a different region." + } + }, "aiAccountName": { "type": "string", "metadata": { @@ -1838,7 +1873,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiAccountName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1860,7 +1895,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiSearchName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1882,7 +1917,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('storageName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1904,7 +1939,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('cosmosDBName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" diff --git a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep index a24054bbc..38da8ca61 100644 --- a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep @@ -4,34 +4,39 @@ Standard Setup Network Secured Steps for main.bicep */ @description('Location for all resources.') @allowed([ - 'westus' + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' - 'canadacentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiServices string = 'aiservices' @@ -267,7 +272,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json index c7961011b..645803bf4 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json @@ -5,37 +5,46 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "1049320424415381171" + "templateHash": "4021946098953778789" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "westeurope", + "canadaeast", + "canadacentral", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -908,7 +917,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -1262,6 +1271,9 @@ "aiAccountName": { "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}-deployment', variables('accountName'), variables('uniqueSuffix'))), '2025-04-01').outputs.accountName.value]" }, + "location": { + "value": "[parameters('location')]" + }, "storageName": { "value": "[reference(resourceId('Microsoft.Resources/deployments', format('dependencies-{0}-deployment', variables('uniqueSuffix'))), '2025-04-01').outputs.azureStorageName.value]" }, @@ -1300,10 +1312,17 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "11525768866797919522" + "templateHash": "2137547566661638544" } }, "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Azure region for the private endpoints. Defaults to the resource group location for backward compatibility; pass the deployment location so private endpoints are co-located with their target resources when the resource group is in a different region." + } + }, "aiAccountName": { "type": "string", "metadata": { @@ -1400,7 +1419,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiAccountName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1422,7 +1441,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('storageName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep index dae749cde..1ef6b213f 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep @@ -1,9 +1,8 @@ -param location string param config object resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: config.name - location: location + location: resourceGroup().location kind: 'AIServices' sku: { name: 'S0' diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep index 34c8e8dc2..333260ed5 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep @@ -11,33 +11,40 @@ use the hosted-agent runtime. */ @description('Location for all resources.') @allowed([ - 'westus' + 'australiaeast' + 'brazilsouth' + 'westeurope' + 'canadaeast' + 'canadacentral' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiServices string = 'aiservices' @@ -181,7 +188,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { name: '${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json index 10b63f589..6dfa3324b 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json @@ -5,37 +5,46 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "9994558897589976517" + "templateHash": "3569752191722183606" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "westeurope", + "canadaeast", + "canadacentral", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -939,7 +948,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -967,7 +976,7 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "2739330245977037380" + "templateHash": "11729420280716349512" } }, "parameters": { @@ -998,6 +1007,13 @@ "networkInjection": { "type": "string", "defaultValue": "true" + }, + "developerIpCidr": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional caller CIDR for authenticated project SDK access. Leave empty for private-only access." + } } }, "resources": [ @@ -1019,10 +1035,10 @@ "networkAcls": { "defaultAction": "Deny", "virtualNetworkRules": [], - "ipRules": [], + "ipRules": "[if(empty(parameters('developerIpCidr')), createArray(), createArray(createObject('value', if(endsWith(parameters('developerIpCidr'), '/32'), split(parameters('developerIpCidr'), '/')[0], parameters('developerIpCidr')))))]", "bypass": "AzureServices" }, - "publicNetworkAccess": "Disabled", + "publicNetworkAccess": "[if(empty(parameters('developerIpCidr')), 'Disabled', 'Enabled')]", "networkInjections": "[if(equals(parameters('networkInjection'), 'true'), createArray(createObject('scenario', 'agent', 'subnetArmId', parameters('agentSubnetId'), 'useMicrosoftManagedNetwork', false())), null())]", "disableLocalAuth": true } @@ -1575,7 +1591,7 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "17319375375259513982" + "templateHash": "3037675488852350266" } }, "parameters": { @@ -1616,6 +1632,13 @@ "description": "Name of the Vnet" } }, + "privateEndpointLocation": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Azure region of the VNet and its private endpoints" + } + }, "peSubnetName": { "type": "string", "metadata": { @@ -1742,7 +1765,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiAccountName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('privateEndpointLocation')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1764,7 +1787,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiSearchName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('privateEndpointLocation')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1786,7 +1809,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('storageName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('privateEndpointLocation')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1808,7 +1831,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('cosmosDBName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('privateEndpointLocation')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" @@ -1831,7 +1854,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('apiManagementName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('privateEndpointLocation')]", "properties": { "subnet": { "id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('vnetSubscriptionId'), parameters('vnetResourceGroupName')), 'Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json index 2d23dbfda..12b2022ca 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "9097858196024894984" + "templateHash": "2291527954509146527" } }, "parameters": { @@ -13,11 +13,10 @@ "type": "string", "defaultValue": "swedencentral", "allowedValues": [ - "eastus2", "swedencentral" ], "metadata": { - "description": "Region for every resource in this sample. The AIGateway SKU is a release-gated preview available only in East US 2 / Sweden Central, and its outbound integration needs a co-regional VNet, so the whole sample deploys in one of these regions." + "description": "Region for resources that require the AI Gateway tier and its co-regional VNet." } }, "aiServices": { @@ -378,7 +377,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('hubName')]", - "location": "[parameters('region')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, @@ -1268,7 +1267,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('region')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep index bfbfd13e8..457620498 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep @@ -35,9 +35,9 @@ - The ModelGateway "Admin-connected models" connection on the project, so an agent references the model as /. - Single region: the AIGateway SKU deploys only in East US 2 / Sweden Central, and - outbound integration requires the VNet in the SAME region, so the whole sample - deploys in one of those regions (default swedencentral). The region parameter is + Single region: the AIGateway SKU is release-gated, and outbound integration + requires the VNet in the SAME region, so the whole sample deploys in Sweden + Central. The region parameter is named `region` (not `location`) so generic tooling that rewrites `location` cannot relocate an AIGateway sample out of its supported regions. @@ -60,10 +60,9 @@ targetScope = 'resourceGroup' // cannot relocate an AIGateway sample out of its supported regions. // --------------------------------------------------------------------------- @allowed([ - 'eastus2' 'swedencentral' ]) -@description('Region for every resource in this sample. The AIGateway SKU is a release-gated preview available only in East US 2 / Sweden Central, and its outbound integration needs a co-regional VNet, so the whole sample deploys in one of these regions.') +@description('Region for resources that require the AI Gateway tier and its co-regional VNet.') param region string = 'swedencentral' // =========================================================================== @@ -259,7 +258,7 @@ module aiAccount '../../modules-network-secured/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: region + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion @@ -575,7 +574,7 @@ resource apimOutboundSubnet 'Microsoft.Network/virtualNetworks/subnets@2024-05-0 // =========================================================================== resource hubAccount 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: hubName - location: region + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json index 956824942..12b2022ca 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "8402656451811108928" + "templateHash": "2291527954509146527" } }, "parameters": { @@ -13,11 +13,10 @@ "type": "string", "defaultValue": "swedencentral", "allowedValues": [ - "eastus2", "swedencentral" ], "metadata": { - "description": "Region for every resource in this sample. The AIGateway SKU is a release-gated preview available only in East US 2 / Sweden Central, and its outbound integration needs a co-regional VNet, so the whole sample deploys in one of these regions." + "description": "Region for resources that require the AI Gateway tier and its co-regional VNet." } }, "aiServices": { @@ -378,7 +377,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('hubName')]", - "location": "[parameters('region')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, @@ -1268,7 +1267,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('region')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -1867,6 +1866,9 @@ "peSubnetName": { "value": "[reference(resourceId('Microsoft.Resources/deployments', format('vnet-{0}-{1}-deployment', variables('trimVnetName'), variables('uniqueSuffix'))), '2025-04-01').outputs.peSubnetName.value]" }, + "privateEndpointLocation": { + "value": "[parameters('region')]" + }, "suffix": { "value": "[variables('uniqueSuffix')]" }, diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep index b5dca56c2..59f8b6935 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep @@ -4,33 +4,40 @@ Standard Setup Network Secured Steps for main.bicep */ @description('Location for all resources.') @allowed([ - 'westus' + 'australiaeast' + 'brazilsouth' + 'westeurope' + 'canadaeast' + 'canadacentral' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiServices string = 'aiservices' @@ -207,7 +214,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json index 3c81141da..b89b6e715 100644 --- a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json @@ -5,37 +5,46 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "3200715244185012959" + "templateHash": "9928725688431345567" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", + "australiaeast", + "brazilsouth", + "westeurope", + "canadaeast", + "canadacentral", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -1025,7 +1034,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep index b310c6b58..994d25820 100644 --- a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep @@ -4,33 +4,40 @@ Standard Setup Network Secured Steps for main.bicep */ @description('Location for all resources.') @allowed([ - 'westus' + 'australiaeast' + 'brazilsouth' + 'westeurope' + 'canadaeast' + 'canadacentral' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiServices string = 'aiservices' @@ -211,7 +218,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json index 37309d909..818471bc9 100644 --- a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json @@ -5,13 +5,46 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "4680182353959664514" + "templateHash": "444853625905726767" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources. Defaults to the resource group location." } @@ -736,7 +769,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -761,7 +794,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "15908440120408802045" + "templateHash": "16980511502916134372" } }, "parameters": { @@ -1532,7 +1565,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "4721773589020153145" + "templateHash": "15999961836015539705" } }, "parameters": { @@ -1738,10 +1771,10 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('ampls-pe-{0}', parameters('suffix')))]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[0])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[1])]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[2])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[3])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[2])]" + "[resourceId('Microsoft.Network/privateDnsZones', variables('amplsDnsZones')[0])]" ] } ], diff --git a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep index 716892fef..1990b8ed1 100644 --- a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep @@ -3,7 +3,40 @@ Standard Setup Managed Network Secured Steps for main.bicep ----------------------------------- */ @description('Location for all resources. Defaults to the resource group location.') -param location string = resourceGroup().location +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('The isolation mode for the managed network') @allowed([ @@ -159,7 +192,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json index 223561bde..dbaebc8b5 100644 --- a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json @@ -5,39 +5,45 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "1473442548359709863" + "templateHash": "3585277827732430552" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus2", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ - "westus", - "westus2", + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", - "japaneast", "francecentral", - "spaincentral", - "uaenorth", - "southcentralus", - "italynorth", "germanywestcentral", - "brazilsouth", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", "southafricanorth", - "australiaeast", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", "swedencentral", - "canadaeast", - "canadacentral", + "switzerlandnorth", + "uaenorth", + "uksouth", "westeurope", + "westus", "westus3", - "uksouth", - "southindia", - "koreacentral", - "polandcentral", - "switzerlandnorth", - "norwayeast" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "Location for all resources." @@ -1412,7 +1418,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" @@ -1942,7 +1948,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "5993399431326858546" + "templateHash": "10057605363040481012" } }, "parameters": { @@ -2282,8 +2288,8 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-private-endpoint', parameters('aiAccountName')))]", - "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('cognitiveServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('openAiDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", + "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('cognitiveServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('aiServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]" ] }, diff --git a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep index 1180c4618..0e71d8528 100644 --- a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep @@ -18,35 +18,39 @@ Architecture: */ @description('Location for all resources.') @allowed([ - 'westus' - 'westus2' + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' - 'japaneast' 'francecentral' - 'spaincentral' - 'uaenorth' - 'southcentralus' - 'italynorth' 'germanywestcentral' - 'brazilsouth' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' 'southafricanorth' - 'australiaeast' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' - 'canadaeast' - 'canadacentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' 'westeurope' + 'westus' 'westus3' - 'uksouth' - 'southindia' - - //only class B and C - 'koreacentral' - 'polandcentral' - 'switzerlandnorth' - 'norwayeast' + 'usgovarizona' + 'usgovvirginia' ]) -param location string = 'eastus2' +param location string = any(resourceGroup().location) @description('Name prefix for your AI Services (Cognitive Services) resource. Lowercase alphanumeric only; a 4-character random suffix will be appended.') @minLength(2) @@ -268,7 +272,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json index 65e3539a4..e4473a158 100644 --- a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "7883696456086450703" + "templateHash": "9897266059106628420" } }, "parameters": { @@ -18,7 +18,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus2", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources." } @@ -108,7 +141,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "UserAssigned", "userAssignedIdentities": { diff --git a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep index 029ca6283..71add9728 100644 --- a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep @@ -15,7 +15,40 @@ param aiFoundryName string = 'foundry-uai' @description('Location for all resources.') -param location string = 'eastus2' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name of the first project') param defaultProjectName string = '${aiFoundryName}-proj' @@ -66,7 +99,7 @@ var userAssignedIdentityPrincipalId = useExistingUserAssignedIdentity ? existing */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'UserAssigned' // Select 'UserAssigned' or 'SystemAssigned,UserAssigned' during creation as this cannot be updated. userAssignedIdentities: { diff --git a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.json b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.json index 65e3539a4..e4473a158 100644 --- a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.json +++ b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "7883696456086450703" + "templateHash": "9897266059106628420" } }, "parameters": { @@ -18,7 +18,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus2", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources." } @@ -108,7 +141,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "UserAssigned", "userAssignedIdentities": { diff --git a/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep b/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep index 50e361e7b..9c68e644f 100644 --- a/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep @@ -9,7 +9,40 @@ param aiFoundryName string = 'entraid-foundry' @description('Location for all resources.') -param location string = 'eastus' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name of the first project') param projectName string = '${aiFoundryName}-proj' @@ -51,7 +84,7 @@ resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' = { */ resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json index 64192cbd4..f3b3a60f1 100644 --- a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "16694821934772097765" + "templateHash": "16150214514525244564" } }, "parameters": { @@ -20,6 +20,39 @@ "location": { "type": "string", "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Location for all resources." } @@ -54,7 +87,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep index 79ac47182..02f49af3f 100644 --- a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep @@ -17,7 +17,40 @@ param aiFoundryName string = 'foundry-cmk' param aiProjectName string = '${aiFoundryName}-proj' @description('Location for all resources.') -param location string = resourceGroup().location +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name of the Azure Key Vault target') param keyVaultName string = 'foundry-int-cmk-akv' @@ -35,7 +68,7 @@ var keyVaultUri = 'https://${keyVaultName}.vault.azure.net/' */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: location + location: resourceGroup().location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json index 4b213588e..9848ee6b2 100644 --- a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json @@ -5,13 +5,46 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "6166861745321957187" + "templateHash": "6982876399509904179" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "The region to deploy your AI Services resource and project" } @@ -111,7 +144,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, @@ -547,7 +580,7 @@ "_generator": { "name": "bicep", "version": "0.39.26.7824", - "templateHash": "17728000413021798670" + "templateHash": "6321066101616137510" } }, "parameters": { diff --git a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep index 9bfa9d05f..312fb9f99 100644 --- a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep @@ -1,7 +1,40 @@ // Standard agent setup @description('The region to deploy your AI Services resource and project') -param location string = 'eastus' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name for your AI Services resource.') param aiFoundryName string = 'aifstdcmk4' @@ -79,7 +112,7 @@ module validateExistingResources 'modules-standard/validate-existing-resources.b */ resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep b/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep index bba9bb54c..a22b4371e 100644 --- a/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep @@ -14,7 +14,40 @@ param aiFoundryName string = 'ai-foundry-complete-cmk' param aiProjectName string = '${aiFoundryName}-proj' @description('Location for all resources.') -param location string = 'eastus2' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Name of the Azure Key Vault target') param keyVaultName string @@ -36,7 +69,7 @@ module aiFoundryAccount './modules/foundry-account.bicep' = { name: 'foundryAccount' params: { aiFoundryName: aiFoundryName - location: location + location: resourceGroup().location userAssignedIdentityId: userAssignedIdentityId } } diff --git a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json index a163246f0..9951b4d77 100644 --- a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "12806942303218057804" + "templateHash": "2360111691865640081" } }, "parameters": { @@ -51,32 +51,39 @@ }, "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ "australiaeast", + "brazilsouth", + "canadacentral", "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", "francecentral", + "germanywestcentral", + "italynorth", "japaneast", "koreacentral", + "northcentralus", + "northeurope", "norwayeast", - "polandcentral", + "qatarcentral", + "southafricanorth", + "southcentralus", "southindia", + "southeastasia", + "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", + "westeurope", "westus", - "westus2", "westus3", - "westeurope", - "southeastasia", - "brazilsouth", - "germanywestcentral", - "italynorth", - "southafricanorth", - "southcentralus" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "The Azure region where your AI Foundry resource and project will be created." @@ -129,7 +136,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, diff --git a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep index 8b72573d9..95e0db93c 100644 --- a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep @@ -23,34 +23,41 @@ param deployApplicationInsights bool = true var appInsightsName = toLower('${uniqueSuffix}appinsights') var logAnalyticsName = toLower('${uniqueSuffix}loganalytics') +@description('The Azure region where your AI Foundry resource and project will be created.') @allowed([ 'australiaeast' + 'brazilsouth' + 'canadacentral' 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' 'francecentral' + 'germanywestcentral' + 'italynorth' 'japaneast' 'koreacentral' + 'northcentralus' + 'northeurope' 'norwayeast' - 'polandcentral' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' 'switzerlandnorth' 'uaenorth' 'uksouth' + 'westeurope' 'westus' - 'westus2' 'westus3' - 'westeurope' - 'southeastasia' - 'brazilsouth' - 'germanywestcentral' - 'italynorth' - 'southafricanorth' - 'southcentralus' + 'usgovarizona' + 'usgovvirginia' ]) -@description('The Azure region where your AI Foundry resource and project will be created.') -param location string = 'eastus' +param location string = any(resourceGroup().location) @description('The name of the OpenAI model you want to deploy') param modelName string = 'gpt-4.1' @@ -69,7 +76,7 @@ param modelCapacity int = 40 resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json index ac3c75933..b940e55e9 100644 --- a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json @@ -5,38 +5,45 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "15348866302693417435" + "templateHash": "1696841767079201030" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ "australiaeast", + "brazilsouth", + "canadacentral", "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", "francecentral", + "germanywestcentral", + "italynorth", "japaneast", "koreacentral", + "northcentralus", + "northeurope", "norwayeast", - "polandcentral", + "qatarcentral", + "southafricanorth", + "southcentralus", "southindia", + "southeastasia", + "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", + "westeurope", "westus", - "westus2", "westus3", - "westeurope", - "southeastasia", - "brazilsouth", - "germanywestcentral", - "italynorth", - "southafricanorth", - "southcentralus" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "The Azure region where your AI Foundry resource and project will be created." @@ -547,7 +554,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep index 94fe49ff6..31327b0ef 100644 --- a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep @@ -1,33 +1,40 @@ // Standard agent setup +@description('The Azure region where your AI Foundry resource and project will be created.') @allowed([ 'australiaeast' + 'brazilsouth' + 'canadacentral' 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' 'francecentral' + 'germanywestcentral' + 'italynorth' 'japaneast' 'koreacentral' + 'northcentralus' + 'northeurope' 'norwayeast' - 'polandcentral' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' 'switzerlandnorth' 'uaenorth' 'uksouth' + 'westeurope' 'westus' - 'westus2' 'westus3' - 'westeurope' - 'southeastasia' - 'brazilsouth' - 'germanywestcentral' - 'italynorth' - 'southafricanorth' - 'southcentralus' + 'usgovarizona' + 'usgovvirginia' ]) -@description('The Azure region where your AI Foundry resource and project will be created.') -param location string = 'eastus' +param location string = any(resourceGroup().location) @maxLength(9) @description('The name of the Azure AI Foundry resource.') @@ -149,7 +156,7 @@ module aiAccount 'modules-standard/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json index 2f37922c0..42c9d2d7b 100644 --- a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "7200235384495896128" + "templateHash": "6849510010229597027" } }, "parameters": { @@ -52,32 +52,39 @@ }, "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ "australiaeast", + "brazilsouth", + "canadacentral", "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", "francecentral", + "germanywestcentral", + "italynorth", "japaneast", "koreacentral", + "northcentralus", + "northeurope", "norwayeast", - "polandcentral", + "qatarcentral", + "southafricanorth", + "southcentralus", "southindia", + "southeastasia", + "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", + "westeurope", "westus", - "westus2", "westus3", - "westeurope", - "southeastasia", - "brazilsouth", - "germanywestcentral", - "italynorth", - "southafricanorth", - "southcentralus" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "The Azure region where your AI Foundry resource and project will be created." @@ -134,7 +141,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "sku": { "name": "S0" }, diff --git a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep index d6d8ce7a4..c2fc99e89 100644 --- a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep @@ -22,34 +22,41 @@ param projectDescription string = 'some description' @description('The display name of your project') param projectDisplayName string = 'project_display_name' +@description('The Azure region where your AI Foundry resource and project will be created.') @allowed([ 'australiaeast' + 'brazilsouth' + 'canadacentral' 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' 'francecentral' + 'germanywestcentral' + 'italynorth' 'japaneast' 'koreacentral' + 'northcentralus' + 'northeurope' 'norwayeast' - 'polandcentral' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' 'switzerlandnorth' 'uaenorth' 'uksouth' + 'westeurope' 'westus' - 'westus2' 'westus3' - 'westeurope' - 'southeastasia' - 'brazilsouth' - 'germanywestcentral' - 'italynorth' - 'southafricanorth' - 'southcentralus' + 'usgovarizona' + 'usgovvirginia' ]) -@description('The Azure region where your AI Foundry resource and project will be created.') -param location string = 'eastus' +param location string = any(resourceGroup().location) // TO DO: Update the resource ID to point to an existing Azure OpenAI resource in your subscription @description('The resource ID of the existing Azure OpenAI resource.') @@ -73,7 +80,7 @@ resource existingAoaiResource 'Microsoft.CognitiveServices/accounts@2023-05-01' resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { #disable-next-line use-stable-resource-identifiers name: accountName - location: location + location: resourceGroup().location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json index 4c1b1ae56..ef70a3077 100644 --- a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json @@ -5,38 +5,45 @@ "_generator": { "name": "bicep", "version": "0.44.1.10279", - "templateHash": "11935496515310596833" + "templateHash": "16745698417344261316" } }, "parameters": { "location": { "type": "string", - "defaultValue": "eastus", + "defaultValue": "[resourceGroup().location]", "allowedValues": [ "australiaeast", + "brazilsouth", + "canadacentral", "canadaeast", + "centralindia", + "centralus", + "eastasia", "eastus", - "eastus2", "francecentral", + "germanywestcentral", + "italynorth", "japaneast", "koreacentral", + "northcentralus", + "northeurope", "norwayeast", - "polandcentral", + "qatarcentral", + "southafricanorth", + "southcentralus", "southindia", + "southeastasia", + "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", + "westeurope", "westus", - "westus2", "westus3", - "westeurope", - "southeastasia", - "brazilsouth", - "germanywestcentral", - "italynorth", - "southafricanorth", - "southcentralus" + "usgovarizona", + "usgovvirginia" ], "metadata": { "description": "The Azure region where your AI Foundry resource and project will be created." @@ -550,7 +557,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" } }, "template": { diff --git a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep index 9ab625da3..5fc500daf 100644 --- a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep @@ -1,33 +1,40 @@ // Standard agent setup with customization +@description('The Azure region where your AI Foundry resource and project will be created.') @allowed([ 'australiaeast' + 'brazilsouth' + 'canadacentral' 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' 'eastus' - 'eastus2' 'francecentral' + 'germanywestcentral' + 'italynorth' 'japaneast' 'koreacentral' + 'northcentralus' + 'northeurope' 'norwayeast' - 'polandcentral' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' 'southindia' + 'southeastasia' + 'spaincentral' 'swedencentral' 'switzerlandnorth' 'uaenorth' 'uksouth' + 'westeurope' 'westus' - 'westus2' 'westus3' - 'westeurope' - 'southeastasia' - 'brazilsouth' - 'germanywestcentral' - 'italynorth' - 'southafricanorth' - 'southcentralus' + 'usgovarizona' + 'usgovvirginia' ]) -@description('The Azure region where your AI Foundry resource and project will be created.') -param location string = 'eastus' +param location string = any(resourceGroup().location) @maxLength(9) @description('The name of the Azure AI Foundry resource.') @@ -144,7 +151,7 @@ module aiAccount 'modules-standard/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: location + location: resourceGroup().location } dependsOn: [ validateExistingResources, aiDependencies diff --git a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json index c6b568e62..c3a8fbc11 100644 --- a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "14639074611483032693" + "templateHash": "6417948001258618961" } }, "parameters": { @@ -27,7 +27,40 @@ }, "location": { "type": "string", - "defaultValue": "eastus" + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ] }, "modelName": { "type": "string", @@ -82,7 +115,7 @@ "value": "[variables('account_name')]" }, "location": { - "value": "[parameters('location')]" + "value": "[resourceGroup().location]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep index 51997c1fb..393969729 100644 --- a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep @@ -2,7 +2,40 @@ param ai_services string = 'aiServices' param project_name string = 'project' param description string = 'some description' param display_name string = 'project_display_name' -param location string = 'eastus' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) param modelName string = 'gpt-4.1' param modelFormat string = 'OpenAI' @@ -33,7 +66,7 @@ module aiAccount 'modules/ai-account-keys.bicep' = { params: { // workspace organization account_name: account_name - location: location + location: resourceGroup().location modelName: modelName modelFormat: modelFormat diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json index f60721594..6c2c8ef68 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json @@ -5,13 +5,46 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "15571043127430806677" + "templateHash": "11620463237502199083" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Azure region for all resources." } @@ -406,7 +439,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('foundryModelAccountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -565,7 +598,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2026-11-15-preview", "name": "[variables('foundryAgentAccountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -648,9 +681,9 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('pe-{0}', variables('foundryAgentAccountName')))]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[0])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]" + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]" ] }, { diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep index f72067f27..b9ce60751 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep @@ -27,7 +27,40 @@ targetScope = 'resourceGroup' // Parameters // ---------------------------------------------------------------------------- @description('Azure region for all resources.') -param location string = resourceGroup().location +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) @description('Region for the Cosmos DB account only. Defaults to location; override (e.g. eastus2) when the main region lacks Cosmos capacity. The Cosmos private endpoint still lands in the spoke VNet in location.') param cosmosLocation string = location @@ -359,7 +392,7 @@ resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = { // ---------------------------------------------------------------------------- resource modelAccount 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: foundryModelAccountName - location: location + location: resourceGroup().location kind: 'AIServices' tags: commonTags sku: { @@ -583,7 +616,7 @@ var trustedCertificateSourcesProperty = enablePrivateCaTrust ? { resource agentAccount 'Microsoft.CognitiveServices/accounts@2026-11-15-preview' = { name: foundryAgentAccountName - location: location + location: resourceGroup().location kind: 'AIServices' tags: commonTags sku: { diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json index f60721594..6c2c8ef68 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json @@ -5,13 +5,46 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "15571043127430806677" + "templateHash": "11620463237502199083" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ], "metadata": { "description": "Azure region for all resources." } @@ -406,7 +439,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('foundryModelAccountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -565,7 +598,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2026-11-15-preview", "name": "[variables('foundryAgentAccountName')]", - "location": "[parameters('location')]", + "location": "[resourceGroup().location]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -648,9 +681,9 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('pe-{0}', variables('foundryAgentAccountName')))]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[0])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]" + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]" ] }, { diff --git a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/example.tfvars index ca03533e2..cdfa09c19 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/example.tfvars @@ -1 +1 @@ -location = "eastus2" +location = "eastus" diff --git a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf index d57a82893..181b3b01b 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf @@ -21,7 +21,7 @@ resource "azurerm_resource_group" "rg" { resource "azurerm_cognitive_account" "ai_foundry" { name = "aifoundry${random_string.unique.result}" - location = var.location + location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name kind = "AIServices" @@ -32,7 +32,7 @@ resource "azurerm_cognitive_account" "ai_foundry" { sku_name = "S0" # required for stateful development in Foundry including agent service - custom_subdomain_name = "aifoundry${random_string.unique.result}" + custom_subdomain_name = "aifoundry${random_string.unique.result}" project_management_enabled = true tags = { @@ -44,7 +44,7 @@ resource "azurerm_cognitive_account" "ai_foundry" { resource "azurerm_cognitive_account_project" "example" { name = "myproject" cognitive_account_id = azurerm_cognitive_account.ai_foundry.id - location = azurerm_resource_group.rg.location + location = azurerm_resource_group.rg.location identity { type = "SystemAssigned" diff --git a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf index 76351d2b4..fb41bfb9e 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf @@ -1,6 +1,43 @@ variable "location" { description = "The name of the location to provision the resources to" type = string + + validation { + condition = contains([ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "usgovarizona", + "usgovvirginia", + "westeurope", + "westus", + "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "subscription_id" { diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars index ca03533e2..cdfa09c19 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars @@ -1 +1 @@ -location = "eastus2" +location = "eastus" diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf b/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf index 506919916..cd7b3f7c6 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf @@ -12,9 +12,9 @@ resource "random_string" "unique" { ## Create a resource group for the resources to be stored in ## resource "azapi_resource" "rg" { - type = "Microsoft.Resources/resourceGroups@2021-04-01" - name = "tf-319-basic" - location = var.location + type = "Microsoft.Resources/resourceGroups@2021-04-01" + name = "tf-319-basic" + location = var.location } ########## Create AI Foundry resource @@ -26,7 +26,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azapi_resource.rg.id - location = var.location + location = azapi_resource.rg.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf b/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf index 76351d2b4..fb41bfb9e 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf @@ -1,6 +1,43 @@ variable "location" { description = "The name of the location to provision the resources to" type = string + + validation { + condition = contains([ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "usgovarizona", + "usgovvirginia", + "westeurope", + "westus", + "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "subscription_id" { diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/example.tfvars index aa897f13b..7be13366b 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/example.tfvars @@ -1,7 +1,7 @@ # Example configuration for storage-speech-language # Azure region -location = "eastus2" +location = "eastus" # AI Foundry account name ai_foundry_name = "foundry-storage" diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf index 6148db9f2..eb4333178 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf @@ -63,7 +63,7 @@ locals { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf index da19b5f10..416be99f1 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/example.tfvars index 810dda390..77072918a 100644 --- a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" custom_subdomain_name = "my-unique-foundry-dns" # Must be globally unique ai_project_name = "custom-dns-proj" model_name = "gpt-4.1-mini" diff --git a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf index 49a4e5c42..14fdcb7e9 100644 --- a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf @@ -24,7 +24,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.custom_subdomain_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf index e26291d06..bf91ba669 100644 --- a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "custom_subdomain_name" { diff --git a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/example.tfvars index dddc42eb1..a8294fd67 100644 --- a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_foundry_name = "foundry-disable-localauth" ai_project_name = "foundry-disable-localauth-proj" model_name = "gpt-4.1-mini" diff --git a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf index 61d37fa4e..1d7191a58 100644 --- a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf @@ -24,7 +24,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf index 4a14bbc37..fdae64026 100644 --- a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/example.tfvars index d6c2f233a..af38fd68f 100644 --- a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_foundry_name = "foundrypnadisabled" virtual_network_name = "private-vnet" virtual_network_address_space = "192.168.0.0/16" diff --git a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf index d1fc017ef..e476556ce 100644 --- a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf @@ -40,7 +40,7 @@ resource "azurerm_subnet" "pe_subnet" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf index c8208e58f..bb7163a37 100644 --- a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf index 1ad7bc611..0e9b08bc9 100644 --- a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf @@ -82,7 +82,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azurerm_resource_group.rg.id - location = var.location + location = azurerm_resource_group.rg.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf index b102dcd25..2ac6dbb2e 100644 --- a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf @@ -20,6 +20,17 @@ variable "private_endpoint_subnet_address_prefix" { variable "location" { description = "The name of the location to provision the resources to" type = string + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "resource_group_name" { diff --git a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf index cee79be36..f3aa8bb40 100644 --- a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf @@ -181,7 +181,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azurerm_resource_group.rg.id - location = var.location + location = azurerm_resource_group.rg.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf index 5d324d72a..183fab06f 100644 --- a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf @@ -20,4 +20,15 @@ variable "private_endpoint_subnet_address_prefix" { variable "location" { description = "The name of the location to provision the resources to" type = string + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } diff --git a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf index 564e53325..c422a31dc 100644 --- a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf @@ -12,6 +12,11 @@ resource "random_string" "unique" { upper = false } +data "azurerm_resource_group" "resources" { + provider = azurerm.workload_subscription + name = var.resource_group_name_resources +} + ########## Create resoures required to for agent data storage ########## @@ -85,7 +90,7 @@ resource "azapi_resource" "ai_search" { type = "Microsoft.Search/searchServices@2025-05-01" name = "aifoundry${random_string.unique.result}search" parent_id = "/subscriptions/${var.subscription_id_resources}/resourceGroups/${var.resource_group_name_resources}" - location = var.location + location = data.azurerm_resource_group.resources.location schema_validation_enabled = true body = { @@ -132,7 +137,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = "/subscriptions/${var.subscription_id_resources}/resourceGroups/${var.resource_group_name_resources}" - location = var.location + location = data.azurerm_resource_group.resources.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf index f7e39f0c3..cb58c16ba 100644 --- a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf @@ -31,4 +31,15 @@ variable "subscription_id_resources" { variable "location" { description = "The name of the location to provision the resources to" type = string + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } diff --git a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/example.tfvars index 26fa99143..02cec2e30 100644 --- a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/example.tfvars @@ -1,7 +1,7 @@ # Example configuration for private network standard agent with API Management # Azure region -location = "eastus2" +location = "eastus" # AI Foundry configuration ai_services_name_prefix = "foundry" diff --git a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf index b828beb6b..1af53cbd6 100644 --- a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf @@ -324,7 +324,7 @@ resource "azurerm_private_endpoint" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf index d0763cb4f..47251ee7d 100644 --- a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/example.tfvars index 16c319a5c..d94184c3b 100644 --- a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/example.tfvars @@ -1,7 +1,7 @@ # Example configuration for private network standard agent with UAI # Azure region -location = "eastus2" +location = "eastus" # AI Foundry configuration ai_services_name_prefix = "foundry" diff --git a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf index ed8ed2dd4..5d36ff36e 100644 --- a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf @@ -223,7 +223,7 @@ resource "azurerm_private_endpoint" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf index fa2de1118..a521c66aa 100644 --- a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/terraform.tfvars.example b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/terraform.tfvars.example index 34ccbebd2..98efae7af 100644 --- a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/terraform.tfvars.example +++ b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/terraform.tfvars.example @@ -2,7 +2,7 @@ # Copy this file to terraform.tfvars and update with your values subscription_id = "%subscription_id%" resource_group_name = "foundry-mvnet-rg" -location = "eastus2" +location = "uaenorth" foundry_identifier = "foundry-v1" # Avoid issues with soft delete, helps make the resource unique # Tags to apply to all resources diff --git a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf index 3f4db5731..084af37ea 100644 --- a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf @@ -12,6 +12,17 @@ variable "location" { description = "Azure region for resources" type = string default = "uaenorth" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "foundry_identifier" { diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/data.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/data.tf index 8588c231c..85e22a012 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/data.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/data.tf @@ -2,6 +2,11 @@ ########## These are only instantiated when using existing resources (count = 0 by default). ########## +data "azurerm_resource_group" "existing" { + count = local.create_rg ? 0 : 1 + name = var.existing_resource_group_name +} + ## Existing Storage Account — needed for primary_blob_endpoint data "azurerm_storage_account" "existing" { count = local.create_storage ? 0 : 1 @@ -18,8 +23,8 @@ data "azurerm_cosmosdb_account" "existing" { ## Existing AI Search — needed for location metadata in connections data "azapi_resource" "existing_search" { - count = local.create_search ? 0 : 1 - type = "Microsoft.Search/searchServices@2024-06-01-preview" - resource_id = var.existing_ai_search_id + count = local.create_search ? 0 : 1 + type = "Microsoft.Search/searchServices@2024-06-01-preview" + resource_id = var.existing_ai_search_id response_export_values = ["location"] } diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf index 6469701fd..234d713b3 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf @@ -23,17 +23,18 @@ locals { create_fabric = var.existing_fabric_workspace_id != "" ## DNS zones — create when no existing resource group provided - create_dns_zones = var.existing_dns_zones_resource_group == "" - dns_zones_sub_id = coalesce(var.existing_dns_zones_subscription_id, data.azurerm_client_config.current.subscription_id) - dns_zones_rg = var.existing_dns_zones_resource_group + create_dns_zones = var.existing_dns_zones_resource_group == "" + dns_zones_sub_id = coalesce(var.existing_dns_zones_subscription_id, data.azurerm_client_config.current.subscription_id) + dns_zones_rg = var.existing_dns_zones_resource_group ########## Unified resource references ########## All downstream code uses these locals instead of direct resource references. ########## ## Resource Group - rg_name = local.create_rg ? azurerm_resource_group.rg[0].name : var.existing_resource_group_name - rg_id = local.create_rg ? azurerm_resource_group.rg[0].id : "/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/${var.existing_resource_group_name}" + rg_name = local.create_rg ? azurerm_resource_group.rg[0].name : var.existing_resource_group_name + rg_id = local.create_rg ? azurerm_resource_group.rg[0].id : "/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/${var.existing_resource_group_name}" + rg_location = local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location ## VNet vnet_id = local.create_vnet ? azurerm_virtual_network.vnet[0].id : var.existing_vnet_id diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf index 82f072306..67e41aed9 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf @@ -151,7 +151,7 @@ resource "azapi_resource" "ai_search" { type = "Microsoft.Search/searchServices@2024-06-01-preview" name = "aifoundry${random_string.unique.result}search" parent_id = local.rg_id - location = var.location + location = local.rg_location schema_validation_enabled = false body = { @@ -211,7 +211,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name parent_id = local.rg_id - location = var.location + location = local.rg_location schema_validation_enabled = false identity { diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf index 8a6947f02..41a61f95a 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf @@ -1,6 +1,17 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/example.tfvars index a72b95b71..62a20b17d 100644 --- a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_foundry_name = "foundry-uai" ai_project_name = "foundry-uai-proj" create_user_assigned_identity = true diff --git a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf index c872780ed..e21afb094 100644 --- a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf @@ -48,7 +48,7 @@ locals { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf index 5cce5399f..2bf5ca648 100644 --- a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/example.tfvars index a5bdd861e..302e34575 100644 --- a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/example.tfvars @@ -1,4 +1,4 @@ -location = "eastus2" +location = "eastus" ai_foundry_name = "foundry-entraid" ai_project_name = "foundry-entraid-proj" model_name = "gpt-4.1-mini" diff --git a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf index 40300b6e3..72c2e4452 100644 --- a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf @@ -45,7 +45,7 @@ resource "azurerm_storage_account" "storage" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf index 0a518ad58..012f98243 100644 --- a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/example.tfvars index 2224815b6..17c13bdda 100644 --- a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_foundry_name = "foundry-cmk" ai_project_name = "foundry-cmk-proj" model_name = "gpt-4.1-mini" diff --git a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf index 4a1e90b5c..7ff083e0e 100644 --- a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf @@ -54,7 +54,7 @@ resource "azurerm_key_vault_key" "cmk" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { @@ -67,8 +67,8 @@ resource "azapi_resource" "ai_foundry" { name = "S0" } properties = { - allowProjectManagement = true - customSubDomainName = "aifoundry${random_string.unique.result}" + allowProjectManagement = true + customSubDomainName = "aifoundry${random_string.unique.result}" disableLocalAuth = false publicNetworkAccess = "Enabled" } diff --git a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf index d90f8cd09..0497d2ad1 100644 --- a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/example.tfvars index 5b8cdcb89..4cccc3336 100644 --- a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/example.tfvars @@ -1,7 +1,7 @@ # Example configuration for customer-managed keys with standard agent # Azure region -location = "eastus2" +location = "eastus" # AI Foundry configuration ai_services_name_prefix = "foundry" diff --git a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf index 6900e1786..61e30ae02 100644 --- a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf @@ -109,7 +109,7 @@ resource "azurerm_cosmosdb_account" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = local.account_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf index 685d84eed..d0a8fa56f 100644 --- a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/example.tfvars index 9fe051a3c..3fb692c22 100644 --- a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/example.tfvars @@ -1,7 +1,7 @@ # Example configuration for customer-managed keys with user-assigned identity # Azure region -location = "eastus2" +location = "eastus" # AI Foundry configuration ai_foundry_name = "foundry-cmk-uai" diff --git a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf index d7c9a9052..64f82cb70 100644 --- a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf @@ -91,7 +91,7 @@ resource "time_sleep" "wait_for_kv_permissions" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf index e96832a93..a8bf8e075 100644 --- a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_foundry_name" { diff --git a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/example.tfvars index b5db0b002..d496f8be9 100644 --- a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_services_name_prefix = "foundry" project_name = "standard-agent-project" model_name = "gpt-4.1" diff --git a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf index d6f6c3d59..3ea7fb7e8 100644 --- a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf @@ -79,7 +79,7 @@ resource "azurerm_cosmosdb_account" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf index 4560e2c7d..4ee862c13 100644 --- a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/example.tfvars index 865ff04d9..4371c68c4 100644 --- a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/example.tfvars @@ -1,7 +1,7 @@ # Example terraform.tfvars file # Copy this to terraform.tfvars and customize for your deployment -location = "eastus2" +location = "eastus" ai_foundry_name = "foundry-bing" ai_project_name = "foundry-bing-proj" bing_api_key = "YOUR_BING_API_KEY_HERE" # Replace with your actual Bing API key diff --git a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf index d1b3bef58..8a8c35070 100644 --- a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf @@ -28,7 +28,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = var.location + location = azurerm_resource_group.rg.location parent_id = azurerm_resource_group.rg.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf index 50ce0d9e0..dd968d65c 100644 --- a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf @@ -1,7 +1,18 @@ variable "location" { description = "The Azure region where resources will be deployed" type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "ai_services_name" { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf index 3e568902e..9d9e0d1e0 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf @@ -8,7 +8,7 @@ resource "azapi_resource" "foundry_agent_account" { provider = azapi.development type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_agent_account_name - location = var.location + location = azurerm_resource_group.development.location parent_id = azurerm_resource_group.development.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/example.tfvars index c94388c2d..b2dbeba69 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/example.tfvars @@ -10,7 +10,7 @@ development_subscription_id = "11111111-1111-1111-1111-111111111111" tenant_id = "33333333-3333-3333-3333-333333333333" # --- Common --- -location = "eastus2" +location = "eastus" name_prefix = "contoso-byom" # --- APIM publisher metadata (required by APIM at create time) --- @@ -35,7 +35,7 @@ groq_api_key = "REPLACE_ME_WITH_GROQ_KEY" # groq_alias = "llama-3-70b" # --- Governance knobs --- -quota_tokens_per_minute = 167 # ~10K tokens/hour per project — demo-friendly +quota_tokens_per_minute = 167 # ~10K tokens/hour per project — demo-friendly # --- Developer group (Sub B) --- # Object ID of the Entra group whose members will get read/use access on diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf index 569c0f0f9..ae57e40b4 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf @@ -5,7 +5,7 @@ resource "azapi_resource" "foundry_model_account" { provider = azapi.platform type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = var.location + location = azurerm_resource_group.platform.location parent_id = azurerm_resource_group.platform.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf index 0799b86cd..c7452582a 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf @@ -20,7 +20,18 @@ variable "tenant_id" { variable "location" { description = "Azure region for all resources in both subscriptions." type = string - default = "eastus2" + default = "eastus" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/01-hub-base/variables.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/01-hub-base/variables.tf index 9724f11a5..a90313df6 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/01-hub-base/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/01-hub-base/variables.tf @@ -16,6 +16,17 @@ variable "location" { description = "Azure region for all hub resources." type = string default = "swedencentral" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/02-spoke-base/variables.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/02-spoke-base/variables.tf index e6e38cfd6..4d1308d4c 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/02-spoke-base/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/02-spoke-base/variables.tf @@ -16,6 +16,17 @@ variable "location" { description = "Azure region. Must match hub-base's location (private DNS zones and peering assume same region)." type = string default = "swedencentral" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "name_prefix" { diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf index 45dd3b65d..b4ac16b63 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf @@ -3,10 +3,14 @@ # in snet-pe. Local auth is disabled per H4 so APIM authenticates as its # system-assigned MI. +data "azurerm_resource_group" "hub" { + name = local.hub_rg_name +} + resource "azapi_resource" "foundry_model_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = local.location + location = data.azurerm_resource_group.hub.location parent_id = local.hub_rg_id identity { diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf index 1fc667e83..ef6dbb964 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf @@ -8,10 +8,14 @@ # through the platform APIM gateway to either the Foundry model account in # the hub or to third-party providers. +data "azurerm_resource_group" "spoke" { + name = local.spoke_rg_name +} + resource "azapi_resource" "foundry_agent_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_agent_account_name - location = local.location + location = data.azurerm_resource_group.spoke.location parent_id = local.spoke_rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf index d71c6605a..a27c014e7 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf @@ -39,7 +39,7 @@ locals { resource "azapi_resource" "foundry_agent_account" { type = "Microsoft.CognitiveServices/accounts@2026-11-15-preview" name = local.foundry_agent_account_name - location = var.location + location = local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location parent_id = local.rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf index 96924f430..6cfffe651 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf @@ -10,7 +10,7 @@ resource "azapi_resource" "foundry_model_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = var.location + location = local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location parent_id = local.rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/terraform.tfvars.example b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/terraform.tfvars.example index a70b770e6..e0b8465e2 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/terraform.tfvars.example +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/terraform.tfvars.example @@ -11,7 +11,7 @@ apim_publisher_email = "admin@contoso.example" # existing_resource_group_name = "" # reuse a group without managing its lifecycle # foundry_allowed_ip_ranges = [] # your client egress IP(s) to reach Foundry for testing # foundry_public_network_access_enabled = false # open Foundry to all networks (prefer the IP list) -# location = "eastus2" # avoid uksouth (trustedCertificates bug) +# location = "swedencentral" # avoid uksouth (trustedCertificates bug) # name_prefix = "byomca" # foundry_model_name = "gpt-4.1" # pick a model offered in your region # foundry_model_version = "2025-04-14" diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf index 9e48da470..e35afed79 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf @@ -13,9 +13,20 @@ variable "tenant_id" { } variable "location" { - description = "Azure region for all resources. Avoid uksouth for this sample: the account trustedCertificates property has a known silent-discard bug there. eastus2 and swedencentral are validated." - type = string - default = "eastus2" + description = "Azure region for all resources. Avoid uksouth for this sample: the account trustedCertificates property has a known silent-discard bug there." + type = string + default = "swedencentral" + + validation { + condition = contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.location) + error_message = "The location must be a supported Microsoft Foundry region." + } } variable "existing_resource_group_name" { From 306874970d0f6edc8d114b6e97f8471e3c0f3a61 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom Date: Thu, 12 Nov 2026 21:20:51 -0800 Subject: [PATCH 02/23] allow location override --- .../00-basic/main.bicep | 2 +- .../01-connections/ai-gateway-tier/main.bicep | 2 +- .../01-connections/connection-foundry.bicep | 39 +++++++++++++++++- .../01-connections/connection-foundry.json | 41 ++++++++++++++++++- .../02-storage-speech-language/README.md | 2 +- .../02-storage-speech-language/main.bicep | 15 ++++++- .../03-custom-dns/main.bicep | 2 +- .../04-disable-local-auth/main.bicep | 2 +- .../10-private-network-basic/main.bicep | 2 +- .../11-private-network-basic-vnet/main.bicep | 1 + .../ai-account-identity.bicep | 3 +- .../main.bicep | 2 +- .../assets/bicep/account.bicep | 36 +++++++++++++++- .../main.bicep | 2 +- .../ai-gateway-tier-private/main.bicep | 6 +-- .../main.bicep | 2 +- .../main.bicep | 2 +- .../18-managed-virtual-network/main.bicep | 2 +- .../19-private-network-agent-tools/main.bicep | 2 +- .../20-user-assigned-identity/main.bicep | 2 +- .../25-entraid-passthrough/main.bicep | 2 +- .../30-customer-managed-keys/main.bicep | 2 +- .../main.bicep | 2 +- .../main.bicep | 2 +- .../40-basic-agent-setup/main.bicep | 2 +- .../41-standard-agent-setup/main.bicep | 2 +- .../main.bicep | 2 +- .../main.bicep | 2 +- .../45-basic-agent-bing/main.bicep | 2 +- .../48-bring-own-model-private-ca/main.bicep | 4 +- .../00-basic-azurerm/code/main.tf | 4 +- .../00-basic-azurerm/code/variables.tf | 17 ++++++++ .../00-basic/code/example.tfvars | 2 + .../00-basic/code/main.tf | 4 +- .../00-basic/code/variables.tf | 17 ++++++++ .../02-storage-speech-language/README.md | 1 + .../02-storage-speech-language/code/main.tf | 20 ++++++++- .../code/variables.tf | 17 ++++++++ .../03-custom-dns/code/main.tf | 4 +- .../03-custom-dns/code/variables.tf | 17 ++++++++ .../04-disable-local-auth/code/main.tf | 4 +- .../04-disable-local-auth/code/variables.tf | 17 ++++++++ .../10-private-network-basic/code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../18-managed-virtual-network/ai-foundry.tf | 4 +- .../18-managed-virtual-network/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../20-user-assigned-identity/code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../25-entraid-passthrough/code/main.tf | 4 +- .../25-entraid-passthrough/code/variables.tf | 17 ++++++++ .../30-customer-managed-keys/code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../code/main.tf | 4 +- .../code/variables.tf | 17 ++++++++ .../41-standard-agent-setup/code/main.tf | 4 +- .../41-standard-agent-setup/code/variables.tf | 17 ++++++++ .../45-basic-agent-bing/code/main.tf | 4 +- .../45-basic-agent-bing/code/variables.tf | 17 ++++++++ .../code/development-foundry.tf | 2 +- .../code/development-projects.tf | 4 +- .../code/platform-foundry.tf | 2 +- .../code/variables.tf | 17 ++++++++ .../04-hub-workload/foundry-account.tf | 2 +- .../04-hub-workload/variables.tf | 17 ++++++++ .../foundry-account.tf | 2 +- .../05-spoke-workload-project/project.tf | 2 +- .../05-spoke-workload-project/variables.tf | 17 ++++++++ .../code/foundry-agent.tf | 2 +- .../code/foundry-model.tf | 2 +- .../code/project.tf | 2 +- .../code/variables.tf | 17 ++++++++ 85 files changed, 633 insertions(+), 83 deletions(-) diff --git a/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep b/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep index 4684c8bad..ad0a1d67c 100644 --- a/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/00-basic/main.bicep @@ -40,7 +40,7 @@ param location string = any(resourceGroup().location) */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep index f52f41348..b6a6ae2ed 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep @@ -138,7 +138,7 @@ var accountName = toLower('${aiServicesName}${uniqueSuffix}') // =========================================================================== resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: resourceGroup().location + location: location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep index df8a914a0..3938baff4 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep +++ b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.bicep @@ -12,16 +12,51 @@ az deployment group create \ Optional parameters: - connectedResourceName: Name of the target Azure AI Foundry resource (default: foundry-{aiFoundryName}) +- location: Target account location (default: deployment resource group location) - newOrExisting: Whether to create new or use existing Azure AI Foundry resource (default: new) - authType: Authentication type - ApiKey or AAD (default: ApiKey) - isSharedToAll: Share connection with all users (default: true) Example with all parameters: -az deployment group create --name AzDeploy --resource-group myResourceGroup --template-file connection-foundry.bicep --parameters aiFoundryName=myFoundry connectedResourceName=myTargetFoundry newOrExisting=existing authType=AAD isSharedToAll=false +az deployment group create --name AzDeploy --resource-group myResourceGroup --template-file connection-foundry.bicep --parameters aiFoundryName=myFoundry connectedResourceName=myTargetFoundry location=westus3 newOrExisting=new authType=AAD isSharedToAll=false */ param aiFoundryName string = '' param connectedResourceName string = 'foundry-${aiFoundryName}' +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) // Whether to create a new Azure AI Foundry resource @allowed([ @@ -54,7 +89,7 @@ resource existingFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-previe // Conditionally creates a new target Azure AI Foundry resource resource newFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if (newOrExisting == 'new') { name: connectedResourceName - location: resourceGroup().location + location: location kind: 'AIServices' sku: { name: 'S0' diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json index 02de93033..994d13678 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json +++ b/infrastructure/infrastructure-setup-bicep/01-connections/connection-foundry.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.37.4.10188", - "templateHash": "14155744296600836147" + "templateHash": "10842231687547934134" } }, "parameters": { @@ -17,6 +17,43 @@ "type": "string", "defaultValue": "[format('foundry-{0}', parameters('aiFoundryName'))]" }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "allowedValues": [ + "australiaeast", + "brazilsouth", + "canadacentral", + "canadaeast", + "centralindia", + "centralus", + "eastasia", + "eastus", + "francecentral", + "germanywestcentral", + "italynorth", + "japaneast", + "koreacentral", + "northcentralus", + "northeurope", + "norwayeast", + "qatarcentral", + "southafricanorth", + "southcentralus", + "southindia", + "southeastasia", + "spaincentral", + "swedencentral", + "switzerlandnorth", + "uaenorth", + "uksouth", + "westeurope", + "westus", + "westus3", + "usgovarizona", + "usgovvirginia" + ] + }, "newOrExisting": { "type": "string", "defaultValue": "new", @@ -44,7 +81,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[parameters('connectedResourceName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "kind": "AIServices", "sku": { "name": "S0" diff --git a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/README.md b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/README.md index eeac1d91b..d9766884b 100644 --- a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/README.md +++ b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/README.md @@ -1,6 +1,6 @@ # Bring Your Own Azure Storage for Speech and Language capabilities (Preview) -Use this template to associate your Azure Storage account to a new Foundry resource. This template allows you to bring an existing Azure Storage account as the storage for your Speech and Language usecases. Learn more about this feature's restrictions via our public documentation. +Use this template to create a Foundry resource and project, then associate an Azure Storage account with the resource for Speech and Language use cases. You can use an existing storage account or create one with the template. Learn more about this feature's restrictions via our public documentation. ## Advanced implementation details ### How is this setup different from an Azure Storage connection in Foundry? diff --git a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep index bf33fe8f6..263923d2c 100644 --- a/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/02-storage-speech-language/main.bicep @@ -5,6 +5,9 @@ @description('Name of the Azure AI Foundry account') param aiFoundryName string +@description('Name of the first project under the Azure AI Foundry account') +param aiProjectName string = '${aiFoundryName}-proj' + @description('Location for the resource') @allowed([ 'australiaeast' @@ -121,7 +124,7 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-01-01' = if (!us // ==================================================================== resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = { name: aiFoundryName - location: resourceGroup().location + location: location sku: { name: 'S0' } @@ -140,6 +143,16 @@ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = { } } +resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = { + name: aiProjectName + parent: aiFoundry + location: location + identity: { + type: 'SystemAssigned' + } + properties: {} +} + // ==================================================================== // STEP 4: CREATE ROLE ASSIGNMENT FOR AI FOUNDRY'S MANAGED IDENTITY // ==================================================================== diff --git a/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep b/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep index a8df065d4..1dcc871cc 100644 --- a/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/03-custom-dns/main.bicep @@ -41,7 +41,7 @@ param location string = any(resourceGroup().location) */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep index 04ceabf0d..5f4a09e58 100644 --- a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/main.bicep @@ -40,7 +40,7 @@ param location string = any(resourceGroup().location) */ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep index 6e32ee677..64fba4161 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep @@ -58,7 +58,7 @@ param peSubnetName string = 'pe-subnet' */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep index a80cbb6d8..4e15d227a 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep @@ -185,6 +185,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { name: '${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep index 0fb44396c..47f72a3be 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep @@ -1,4 +1,5 @@ param accountName string +param location string param modelName string param modelFormat string param modelVersion string @@ -10,7 +11,7 @@ param networkInjection string = 'true' #disable-next-line BCP036 resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: resourceGroup().location + location: location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep index 38da8ca61..7a87b3006 100644 --- a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep @@ -272,7 +272,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep index 1ef6b213f..1c4946de2 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep @@ -1,8 +1,42 @@ +@allowed([ + 'australiaeast' + 'brazilsouth' + 'canadacentral' + 'canadaeast' + 'centralindia' + 'centralus' + 'eastasia' + 'eastus' + 'francecentral' + 'germanywestcentral' + 'italynorth' + 'japaneast' + 'koreacentral' + 'northcentralus' + 'northeurope' + 'norwayeast' + 'qatarcentral' + 'southafricanorth' + 'southcentralus' + 'southindia' + 'southeastasia' + 'spaincentral' + 'swedencentral' + 'switzerlandnorth' + 'uaenorth' + 'uksouth' + 'westeurope' + 'westus' + 'westus3' + 'usgovarizona' + 'usgovvirginia' +]) +param location string = any(resourceGroup().location) param config object resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: config.name - location: resourceGroup().location + location: location kind: 'AIServices' sku: { name: 'S0' diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep index 333260ed5..455c781a5 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep @@ -188,7 +188,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { name: '${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep index 457620498..c95ef615c 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep @@ -63,7 +63,7 @@ targetScope = 'resourceGroup' 'swedencentral' ]) @description('Region for resources that require the AI Gateway tier and its co-regional VNet.') -param region string = 'swedencentral' +param region string = any(resourceGroup().location) // =========================================================================== // Foundation inputs (template 16 standard network-secured agent) @@ -258,7 +258,7 @@ module aiAccount '../../modules-network-secured/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: resourceGroup().location + location: region modelName: modelName modelFormat: modelFormat modelVersion: modelVersion @@ -574,7 +574,7 @@ resource apimOutboundSubnet 'Microsoft.Network/virtualNetworks/subnets@2024-05-0 // =========================================================================== resource hubAccount 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: hubName - location: resourceGroup().location + location: region sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep index 59f8b6935..4c9fb6752 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep @@ -214,7 +214,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep index 994d25820..755b3381f 100644 --- a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep @@ -218,7 +218,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep index 1990b8ed1..c0f9b33e7 100644 --- a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/main.bicep @@ -192,7 +192,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep index 0e71d8528..a70096394 100644 --- a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep @@ -272,7 +272,7 @@ module aiAccount 'modules-network-secured/ai-account-identity.bicep' = { params: { // workspace organization accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep index 71add9728..7d987c5ba 100644 --- a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/main.bicep @@ -99,7 +99,7 @@ var userAssignedIdentityPrincipalId = useExistingUserAssignedIdentity ? existing */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'UserAssigned' // Select 'UserAssigned' or 'SystemAssigned,UserAssigned' during creation as this cannot be updated. userAssignedIdentities: { diff --git a/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep b/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep index 9c68e644f..b21423333 100644 --- a/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/25-entraid-passthrough/main.bicep @@ -84,7 +84,7 @@ resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' = { */ resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep index 02f49af3f..3fc44f8cf 100644 --- a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/main.bicep @@ -68,7 +68,7 @@ var keyVaultUri = 'https://${keyVaultName}.vault.azure.net/' */ resource account 'Microsoft.CognitiveServices/accounts@2025-06-01' = { name: aiFoundryName - location: resourceGroup().location + location: location identity: { type: 'SystemAssigned' } diff --git a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep index 312fb9f99..40063b65c 100644 --- a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep @@ -112,7 +112,7 @@ module validateExistingResources 'modules-standard/validate-existing-resources.b */ resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: resourceGroup().location + location: location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep b/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep index a22b4371e..ff3142df1 100644 --- a/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep @@ -69,7 +69,7 @@ module aiFoundryAccount './modules/foundry-account.bicep' = { name: 'foundryAccount' params: { aiFoundryName: aiFoundryName - location: resourceGroup().location + location: location userAssignedIdentityId: userAssignedIdentityId } } diff --git a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep index 95e0db93c..b7ddb322c 100644 --- a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/main.bicep @@ -76,7 +76,7 @@ param modelCapacity int = 40 resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: accountName - location: resourceGroup().location + location: location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep index 31327b0ef..89ef3898a 100644 --- a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/main.bicep @@ -156,7 +156,7 @@ module aiAccount 'modules-standard/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat modelVersion: modelVersion diff --git a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep index c2fc99e89..31e908477 100644 --- a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep @@ -80,7 +80,7 @@ resource existingAoaiResource 'Microsoft.CognitiveServices/accounts@2023-05-01' resource account 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { #disable-next-line use-stable-resource-identifiers name: accountName - location: resourceGroup().location + location: location sku: { name: 'S0' } diff --git a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep index 5fc500daf..4c21361cf 100644 --- a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep @@ -151,7 +151,7 @@ module aiAccount 'modules-standard/ai-account-identity.bicep' = { name: 'ai-${accountName}-${uniqueSuffix}-deployment' params: { accountName: accountName - location: resourceGroup().location + location: location } dependsOn: [ validateExistingResources, aiDependencies diff --git a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep index 393969729..edab8f4fa 100644 --- a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/main.bicep @@ -66,7 +66,7 @@ module aiAccount 'modules/ai-account-keys.bicep' = { params: { // workspace organization account_name: account_name - location: resourceGroup().location + location: location modelName: modelName modelFormat: modelFormat diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep index b9ce60751..e73aa87bc 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep @@ -392,7 +392,7 @@ resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = { // ---------------------------------------------------------------------------- resource modelAccount 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = { name: foundryModelAccountName - location: resourceGroup().location + location: location kind: 'AIServices' tags: commonTags sku: { @@ -616,7 +616,7 @@ var trustedCertificateSourcesProperty = enablePrivateCaTrust ? { resource agentAccount 'Microsoft.CognitiveServices/accounts@2026-11-15-preview' = { name: foundryAgentAccountName - location: resourceGroup().location + location: location kind: 'AIServices' tags: commonTags sku: { diff --git a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf index 181b3b01b..82ae9cee4 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/main.tf @@ -21,7 +21,7 @@ resource "azurerm_resource_group" "rg" { resource "azurerm_cognitive_account" "ai_foundry" { name = "aifoundry${random_string.unique.result}" - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) resource_group_name = azurerm_resource_group.rg.name kind = "AIServices" @@ -44,7 +44,7 @@ resource "azurerm_cognitive_account" "ai_foundry" { resource "azurerm_cognitive_account_project" "example" { name = "myproject" cognitive_account_id = azurerm_cognitive_account.ai_foundry.id - location = azurerm_resource_group.rg.location + location = azurerm_cognitive_account.ai_foundry.location identity { type = "SystemAssigned" diff --git a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf index fb41bfb9e..1779c54a1 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf @@ -40,6 +40,23 @@ variable "location" { } } +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "subscription_id" { type = string } \ No newline at end of file diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars b/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars index cdfa09c19..d39ef7c14 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/example.tfvars @@ -1 +1,3 @@ location = "eastus" +# Optional Foundry account region override; defaults to the resource-group location. +# foundry_location = "westus3" diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf b/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf index cd7b3f7c6..dfefe2947 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/main.tf @@ -26,7 +26,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azapi_resource.rg.id - location = azapi_resource.rg.location + location = coalesce(var.foundry_location, azapi_resource.rg.location) schema_validation_enabled = false body = { @@ -82,7 +82,7 @@ resource "azapi_resource" "ai_foundry_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = "project${random_string.unique.result}" parent_id = azapi_resource.ai_foundry.id - location = var.location + location = azapi_resource.ai_foundry.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf b/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf index fb41bfb9e..089b7c9e4 100644 --- a/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/00-basic/code/variables.tf @@ -42,4 +42,21 @@ variable "location" { variable "subscription_id" { type = string +} + +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } } \ No newline at end of file diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/README.md b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/README.md index cdcadd167..597a0572f 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/README.md +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/README.md @@ -24,6 +24,7 @@ These examples can be adapted and integrated into your Terraform configurations. This folder now includes a full Terraform sample with: - Microsoft Foundry account configured for user-owned storage +- Microsoft Foundry project under the account - Optional Speech and Language resource deployment switches - Storage RBAC wiring for the account identity diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf index eb4333178..247657ae3 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/main.tf @@ -63,7 +63,7 @@ locals { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -89,6 +89,24 @@ resource "azapi_resource" "ai_foundry" { } } +resource "azapi_resource" "ai_foundry_project" { + type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" + name = "${var.ai_foundry_name}-proj" + parent_id = azapi_resource.ai_foundry.id + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) + schema_validation_enabled = false + + identity { + type = "SystemAssigned" + } + + body = { + properties = {} + } + + depends_on = [time_sleep.wait_for_ai_foundry] +} + ## Wait for AI Foundry creation to ensure identity is available resource "time_sleep" "wait_for_ai_foundry" { depends_on = [azapi_resource.ai_foundry] diff --git a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf index 416be99f1..a2f6e9814 100644 --- a/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf index 14fdcb7e9..f7c14c66f 100644 --- a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/main.tf @@ -24,7 +24,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.custom_subdomain_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -49,7 +49,7 @@ resource "azapi_resource" "ai_foundry" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = var.ai_project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf index bf91ba669..9885415fd 100644 --- a/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/03-custom-dns/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf index 1d7191a58..ad8e15ab3 100644 --- a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/main.tf @@ -24,7 +24,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -49,7 +49,7 @@ resource "azapi_resource" "ai_foundry" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = coalesce(var.ai_project_name, "${var.ai_foundry_name}-proj") - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf index fdae64026..f73c6d339 100644 --- a/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf index e476556ce..aad299620 100644 --- a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/main.tf @@ -40,7 +40,7 @@ resource "azurerm_subnet" "pe_subnet" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -136,7 +136,7 @@ resource "azurerm_private_endpoint" "ai_foundry_pe" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = coalesce(var.ai_project_name, "${var.ai_foundry_name}-proj") - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf index bb7163a37..5ead03472 100644 --- a/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/10-private-network-basic/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf index 0e9b08bc9..3132c4293 100644 --- a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf @@ -82,7 +82,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azurerm_resource_group.rg.id - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) schema_validation_enabled = false body = { @@ -254,7 +254,7 @@ resource "azapi_resource" "ai_foundry_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = "project${random_string.unique.result}" parent_id = azapi_resource.ai_foundry.id - location = var.location + location = azapi_resource.ai_foundry.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf index 2ac6dbb2e..1ade80d7e 100644 --- a/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + ## As of 6/2025 the agent subnet is limited to RFC1918 Class B and Class C address space variable "virtual_network_address_space" { description = "The address space for the virtual network" diff --git a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf index f3aa8bb40..fadd638cf 100644 --- a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf @@ -181,7 +181,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = azurerm_resource_group.rg.id - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) schema_validation_enabled = false body = { @@ -501,7 +501,7 @@ resource "azapi_resource" "ai_foundry_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = "project${random_string.unique.result}" parent_id = azapi_resource.ai_foundry.id - location = var.location + location = azapi_resource.ai_foundry.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf index 183fab06f..6a61983ee 100644 --- a/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + ## As of 6/2025 this is limited to RFC1918 Class B and Class C address space variable "virtual_network_address_space" { description = "The address space for the virtual network" diff --git a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf index c422a31dc..2f0c82880 100644 --- a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf @@ -137,7 +137,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = "aifoundry${random_string.unique.result}" parent_id = "/subscriptions/${var.subscription_id_resources}/resourceGroups/${var.resource_group_name_resources}" - location = data.azurerm_resource_group.resources.location + location = coalesce(var.foundry_location, data.azurerm_resource_group.resources.location) schema_validation_enabled = false body = { @@ -346,7 +346,7 @@ resource "azapi_resource" "ai_foundry_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = "project${random_string.unique.result}" parent_id = azapi_resource.ai_foundry.id - location = var.location + location = azapi_resource.ai_foundry.location schema_validation_enabled = false body = { diff --git a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf index cb58c16ba..28759b3a0 100644 --- a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "resource_group_name_resources" { description = "The name of the existing resource group to deploy the resources into" type = string diff --git a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf index 1af53cbd6..aaec1c9e0 100644 --- a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf @@ -324,7 +324,7 @@ resource "azurerm_private_endpoint" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -436,7 +436,7 @@ resource "time_sleep" "wait_for_resources" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf index 47251ee7d..c37be73f9 100644 --- a/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf index 5d36ff36e..ea0545a85 100644 --- a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf @@ -223,7 +223,7 @@ resource "azurerm_private_endpoint" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -317,7 +317,7 @@ resource "time_sleep" "wait_for_rbac" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf index a521c66aa..dfd0ffc15 100644 --- a/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/ai-foundry.tf b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/ai-foundry.tf index c33ea9997..3c60e568c 100644 --- a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/ai-foundry.tf +++ b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/ai-foundry.tf @@ -2,7 +2,7 @@ resource "azapi_resource" "cognitive_account" { type = "Microsoft.CognitiveServices/accounts@2025-10-01-preview" name = local.foundry_name - location = azurerm_resource_group.main.location + location = coalesce(var.foundry_location, azurerm_resource_group.main.location) parent_id = azurerm_resource_group.main.id schema_validation_enabled = false @@ -259,7 +259,7 @@ resource "azapi_resource" "a365_frontdoor_outbound_rule" { resource "azapi_resource" "ai_foundry_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = "firstProject" - location = var.location + location = azapi_resource.cognitive_account.location parent_id = azapi_resource.cognitive_account.id schema_validation_enabled = false diff --git a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf index 084af37ea..dfabd81c3 100644 --- a/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/18-managed-virtual-network/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "subscription_id" { description = "The Azure subscription ID" type = string diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf index 67e41aed9..3161a3b5e 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf @@ -211,7 +211,7 @@ resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name parent_id = local.rg_id - location = local.rg_location + location = coalesce(var.foundry_location, local.rg_location) schema_validation_enabled = false identity { @@ -524,7 +524,7 @@ resource "azapi_resource" "ai_project" { ] type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id schema_validation_enabled = false diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf index 41a61f95a..7c96fa420 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf index e21afb094..10fb47343 100644 --- a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf @@ -48,7 +48,7 @@ locals { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -74,7 +74,7 @@ resource "azapi_resource" "ai_foundry" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = coalesce(var.ai_project_name, "${var.ai_foundry_name}-proj") - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf index 2bf5ca648..d3ae47bd2 100644 --- a/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf index 72c2e4452..6d3df0109 100644 --- a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf @@ -45,7 +45,7 @@ resource "azurerm_storage_account" "storage" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -70,7 +70,7 @@ resource "azapi_resource" "ai_foundry" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.ai_project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf index 012f98243..845d001d5 100644 --- a/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf index 7ff083e0e..0d5d3e021 100644 --- a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf @@ -54,7 +54,7 @@ resource "azurerm_key_vault_key" "cmk" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -113,7 +113,7 @@ resource "azapi_update_resource" "ai_foundry_cmk" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = coalesce(var.ai_project_name, "${var.ai_foundry_name}-proj") - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf index 0497d2ad1..af66f45b0 100644 --- a/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf index 61e30ae02..7c7c68b8e 100644 --- a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf @@ -109,7 +109,7 @@ resource "azurerm_cosmosdb_account" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = local.account_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -221,7 +221,7 @@ resource "time_sleep" "wait_for_rbac" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf index d0a8fa56f..3f07a656d 100644 --- a/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf index 64f82cb70..15a8f1aaa 100644 --- a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf @@ -91,7 +91,7 @@ resource "time_sleep" "wait_for_kv_permissions" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-06-01" name = var.ai_foundry_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -140,7 +140,7 @@ resource "azapi_update_resource" "ai_foundry_cmk" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-06-01" name = coalesce(var.ai_project_name, "${var.ai_foundry_name}-proj") - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf index a8bf8e075..684770d7d 100644 --- a/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf index 3ea7fb7e8..2e2678811 100644 --- a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf @@ -79,7 +79,7 @@ resource "azurerm_cosmosdb_account" "cosmos" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -147,7 +147,7 @@ resource "time_sleep" "wait_for_rbac" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf index 4ee862c13..b58a33c7d 100644 --- a/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf index 8a8c35070..8581743b9 100644 --- a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf @@ -28,7 +28,7 @@ resource "azurerm_resource_group" "rg" { resource "azapi_resource" "ai_foundry" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.account_name - location = azurerm_resource_group.rg.location + location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) parent_id = azurerm_resource_group.rg.id identity { @@ -78,7 +78,7 @@ resource "azapi_resource" "model_deployment" { resource "azapi_resource" "ai_project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = var.location + location = azapi_resource.ai_foundry.location parent_id = azapi_resource.ai_foundry.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf index dd968d65c..bcbc3462a 100644 --- a/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "location" { description = "The Azure region where resources will be deployed" type = string diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf index 9d9e0d1e0..81d513e40 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf @@ -8,7 +8,7 @@ resource "azapi_resource" "foundry_agent_account" { provider = azapi.development type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_agent_account_name - location = azurerm_resource_group.development.location + location = coalesce(var.foundry_location, azurerm_resource_group.development.location) parent_id = azurerm_resource_group.development.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-projects.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-projects.tf index f64bbcdc3..25b7c023e 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-projects.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/development-projects.tf @@ -7,7 +7,7 @@ resource "azapi_resource" "project_alpha" { provider = azapi.development type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = "alpha" - location = var.location + location = azapi_resource.foundry_agent_account.location parent_id = azapi_resource.foundry_agent_account.id identity { @@ -26,7 +26,7 @@ resource "azapi_resource" "project_beta" { provider = azapi.development type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = "beta" - location = var.location + location = azapi_resource.foundry_agent_account.location parent_id = azapi_resource.foundry_agent_account.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf index ae57e40b4..bd298c7e8 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf @@ -5,7 +5,7 @@ resource "azapi_resource" "foundry_model_account" { provider = azapi.platform type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = azurerm_resource_group.platform.location + location = coalesce(var.foundry_location, azurerm_resource_group.platform.location) parent_id = azurerm_resource_group.platform.id identity { diff --git a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf index c7452582a..7a64e2a89 100644 --- a/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to each account's resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + # ============================================================================ # Subscription and location inputs # ============================================================================ diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf index b4ac16b63..7ab25f53e 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf @@ -10,7 +10,7 @@ data "azurerm_resource_group" "hub" { resource "azapi_resource" "foundry_model_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = data.azurerm_resource_group.hub.location + location = coalesce(var.foundry_location, data.azurerm_resource_group.hub.location) parent_id = local.hub_rg_id identity { diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/variables.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/variables.tf index 102964abf..a9d4ee2ef 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/variables.tf @@ -12,6 +12,23 @@ variable "tenant_id" { type = string } +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the hub resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "name_prefix" { description = "Same as hub-base's name_prefix. Used for names of workload resources placed alongside hub-base's resources." type = string diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf index ef6dbb964..742452668 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf @@ -15,7 +15,7 @@ data "azurerm_resource_group" "spoke" { resource "azapi_resource" "foundry_agent_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_agent_account_name - location = data.azurerm_resource_group.spoke.location + location = coalesce(var.foundry_location, data.azurerm_resource_group.spoke.location) parent_id = local.spoke_rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/project.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/project.tf index 6c4483937..8a1b14040 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/project.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/project.tf @@ -7,7 +7,7 @@ resource "azapi_resource" "project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = var.project_name - location = local.location + location = azapi_resource.foundry_agent_account.location parent_id = azapi_resource.foundry_agent_account.id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/variables.tf b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/variables.tf index 1aa8cf543..beea58a9a 100644 --- a/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/variables.tf @@ -8,6 +8,23 @@ variable "tenant_id" { type = string } +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the spoke resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + variable "name_prefix" { description = "Same as spoke-base's name_prefix." type = string diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf index a27c014e7..2da10eb41 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf @@ -39,7 +39,7 @@ locals { resource "azapi_resource" "foundry_agent_account" { type = "Microsoft.CognitiveServices/accounts@2026-11-15-preview" name = local.foundry_agent_account_name - location = local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location + location = coalesce(var.foundry_location, local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location) parent_id = local.rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf index 6cfffe651..a1d8762c9 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf @@ -10,7 +10,7 @@ resource "azapi_resource" "foundry_model_account" { type = "Microsoft.CognitiveServices/accounts@2025-04-01-preview" name = local.foundry_model_account_name - location = local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location + location = coalesce(var.foundry_location, local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location) parent_id = local.rg_id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/project.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/project.tf index 1dee9fb8e..a61c73415 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/project.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/project.tf @@ -8,7 +8,7 @@ resource "azapi_resource" "project" { type = "Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview" name = "${var.name_prefix}-project" - location = var.location + location = azapi_resource.foundry_agent_account.location parent_id = azapi_resource.foundry_agent_account.id tags = local.common_tags diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf index e35afed79..0c2a87e1b 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf @@ -1,3 +1,20 @@ +variable "foundry_location" { + description = "Optional Foundry account location override. Defaults to the resource-group location." + type = string + default = null + + validation { + condition = var.foundry_location == null ? true : contains([ + "australiaeast", "brazilsouth", "canadacentral", "canadaeast", "centralindia", "centralus", + "eastasia", "eastus", "francecentral", "germanywestcentral", "italynorth", "japaneast", + "koreacentral", "northcentralus", "northeurope", "norwayeast", "qatarcentral", "southafricanorth", + "southcentralus", "southindia", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", + "uaenorth", "uksouth", "usgovarizona", "usgovvirginia", "westeurope", "westus", "westus3", + ], var.foundry_location) + error_message = "The location must be a supported Microsoft Foundry region." + } +} + # ============================================================================ # Subscription, tenant, location # ============================================================================ From 456dd6c62aa0334fcfcf683d145ac1a953a9fe71 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 13 Nov 2026 05:28:03 +0000 Subject: [PATCH 03/23] Regenerate private network templates for location override Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com> --- .../10-private-network-basic/azuredeploy.json | 6 +++--- .../10-private-network-basic/main.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json index 00547e0a2..ecb0a6f99 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.44.1.10279", - "templateHash": "8690465677147923595" + "version": "0.48.1.52935", + "templateHash": "13386588499278082521" } }, "parameters": { @@ -83,7 +83,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json index 59467f257..ecb0a6f99 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.35.1.17967", - "templateHash": "2708602652802231157" + "version": "0.48.1.52935", + "templateHash": "13386588499278082521" } }, "parameters": { @@ -83,7 +83,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, From 1bb99d2eaf03162593b9f7a8114bf07d83faae08 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 13 Nov 2026 05:30:29 +0000 Subject: [PATCH 04/23] Sync disable-local-auth ARM template location Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com> --- .../04-disable-local-auth/azuredeploy.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json index 3e3129a5d..23d20cbae 100644 --- a/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.39.26.7824", - "templateHash": "10340953561333823360" + "version": "0.48.1.52935", + "templateHash": "9490626156247361104" } }, "parameters": { @@ -60,7 +60,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, From eaf4a24271ec8339d0c9b1f7c5fab6da15b7f412 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 13 Nov 2026 05:44:14 +0000 Subject: [PATCH 05/23] Fix remaining region alignment findings Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com> --- .../10-private-network-basic/azuredeploy.json | 4 ++-- .../10-private-network-basic/main.bicep | 2 +- .../10-private-network-basic/main.json | 4 ++-- .../azuredeploy.json | 3 ++- .../main.bicep | 1 + .../azuredeploy.json | 3 ++- .../main.bicep | 1 + .../19-private-network-agent-tools/azuredeploy.json | 11 ++++++----- .../19-private-network-agent-tools/main.bicep | 1 + .../48-bring-own-model-private-ca/azuredeploy.json | 13 +++++++------ .../48-bring-own-model-private-ca/main.bicep | 1 + .../48-bring-own-model-private-ca/main.json | 13 +++++++------ .../code/main.tf | 9 ++++++++- .../code/locals.tf | 2 +- .../code/main.tf | 7 +++++++ .../code/foundry-agent.tf | 7 +++++++ 16 files changed, 56 insertions(+), 26 deletions(-) diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json index ecb0a6f99..a1bb88314 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "13386588499278082521" + "templateHash": "9333187855641087974" } }, "parameters": { @@ -134,7 +134,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiFoundryName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep index 64fba4161..0fe8f4579 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.bicep @@ -122,7 +122,7 @@ Step 3: Create a private endpoint to access your private resource // - Establishes private connection to AI Services account resource aiAccountPrivateEndpoint 'Microsoft.Network/privateEndpoints@2024-05-01' = { name: '${aiFoundryName}-private-endpoint' - location: resourceGroup().location + location: location properties: { subnet: { id: subnet.id // Deploy in customer hub subnet diff --git a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json index ecb0a6f99..a1bb88314 100644 --- a/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json +++ b/infrastructure/infrastructure-setup-bicep/10-private-network-basic/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "13386588499278082521" + "templateHash": "9333187855641087974" } }, "parameters": { @@ -134,7 +134,7 @@ "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2024-05-01", "name": "[format('{0}-private-endpoint', parameters('aiFoundryName'))]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('peSubnetName'))]" diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json index 6dfa3324b..b3e1cc756 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json @@ -22,6 +22,7 @@ "centralus", "eastasia", "eastus", + "eastus2", "francecentral", "germanywestcentral", "italynorth", @@ -948,7 +949,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep index 4c9fb6752..bc3fa68c3 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep @@ -13,6 +13,7 @@ Standard Setup Network Secured Steps for main.bicep 'centralus' 'eastasia' 'eastus' + 'eastus2' 'francecentral' 'germanywestcentral' 'italynorth' diff --git a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json index b89b6e715..74fd7b14b 100644 --- a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json @@ -22,6 +22,7 @@ "centralus", "eastasia", "eastus", + "eastus2", "francecentral", "germanywestcentral", "italynorth", @@ -1034,7 +1035,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" diff --git a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep index 755b3381f..0a719e061 100644 --- a/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep @@ -13,6 +13,7 @@ Standard Setup Network Secured Steps for main.bicep 'centralus' 'eastasia' 'eastus' + 'eastus2' 'francecentral' 'germanywestcentral' 'italynorth' diff --git a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json index dbaebc8b5..f9c435c6e 100644 --- a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "3585277827732430552" + "templateHash": "12442000905807844856" } }, "parameters": { @@ -21,6 +21,7 @@ "centralus", "eastasia", "eastus", + "eastus2", "francecentral", "germanywestcentral", "italynorth", @@ -1418,7 +1419,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" @@ -1948,7 +1949,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "10057605363040481012" + "templateHash": "13245946831715248629" } }, "parameters": { @@ -2288,9 +2289,9 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-private-endpoint', parameters('aiAccountName')))]", + "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('aiServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('openAiDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", - "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('cognitiveServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]", - "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('aiServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]" + "[resourceId('Microsoft.Resources/deployments', format('dns-{0}-{1}', replace(variables('dnsZoneEntries')[indexOf(variables('dnsZoneKeys'), variables('cognitiveServicesDnsZoneName'))].key, '.', '-'), parameters('suffix')))]" ] }, { diff --git a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep index a70096394..86e6e9760 100644 --- a/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep @@ -26,6 +26,7 @@ Architecture: 'centralus' 'eastasia' 'eastus' + 'eastus2' 'francecentral' 'germanywestcentral' 'italynorth' diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json index 6c2c8ef68..929c194a7 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "11620463237502199083" + "templateHash": "2730794585217518261" } }, "parameters": { @@ -21,6 +21,7 @@ "centralus", "eastasia", "eastus", + "eastus2", "francecentral", "germanywestcentral", "italynorth", @@ -233,7 +234,7 @@ "roleSearchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7", "roleSearchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0", "cosmosBuiltInDataContributorRoleId": "00000000-0000-0000-0000-000000000002", - "nginxConfTemplate": "worker_processes 1;\r\nerror_log /dev/stderr warn;\r\npid /tmp/nginx.pid;\r\nevents { worker_connections 1024; }\r\nhttp {\r\n include /etc/nginx/mime.types;\r\n default_type application/octet-stream;\r\n access_log /dev/stdout;\r\n proxy_http_version 1.1;\r\n server {\r\n listen 443 ssl;\r\n server_name __FQDN__;\r\n ssl_certificate /mnt/certs/server.crt;\r\n ssl_certificate_key /mnt/certs/server.key;\r\n location /__APIPATH__/ {\r\n proxy_pass https://__MODELHOST__/openai/;\r\n proxy_set_header Host __MODELHOST__;\r\n proxy_ssl_server_name on;\r\n proxy_ssl_name __MODELHOST__;\r\n proxy_ssl_verify on;\r\n proxy_ssl_verify_depth 3;\r\n proxy_ssl_trusted_certificate /etc/pki/tls/certs/ca-bundle.crt;\r\n }\r\n location / { return 200 'gateway-ok'; }\r\n }\r\n}\r\n", + "nginxConfTemplate": "worker_processes 1;\nerror_log /dev/stderr warn;\npid /tmp/nginx.pid;\nevents { worker_connections 1024; }\nhttp {\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n access_log /dev/stdout;\n proxy_http_version 1.1;\n server {\n listen 443 ssl;\n server_name __FQDN__;\n ssl_certificate /mnt/certs/server.crt;\n ssl_certificate_key /mnt/certs/server.key;\n location /__APIPATH__/ {\n proxy_pass https://__MODELHOST__/openai/;\n proxy_set_header Host __MODELHOST__;\n proxy_ssl_server_name on;\n proxy_ssl_name __MODELHOST__;\n proxy_ssl_verify on;\n proxy_ssl_verify_depth 3;\n proxy_ssl_trusted_certificate /etc/pki/tls/certs/ca-bundle.crt;\n }\n location / { return 200 'gateway-ok'; }\n }\n}\n", "nginxConf": "[replace(replace(replace(variables('nginxConfTemplate'), '__FQDN__', variables('customDomainFqdn')), '__APIPATH__', variables('apimApiPath')), '__MODELHOST__', variables('modelHost'))]", "agentAccountBaseProperties": { "allowProjectManagement": true, @@ -439,7 +440,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('foundryModelAccountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -598,7 +599,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2026-11-15-preview", "name": "[variables('foundryAgentAccountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -681,9 +682,9 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('pe-{0}', variables('foundryAgentAccountName')))]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[0])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]" + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]" ] }, { diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep index e73aa87bc..b43d52196 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep @@ -36,6 +36,7 @@ targetScope = 'resourceGroup' 'centralus' 'eastasia' 'eastus' + 'eastus2' 'francecentral' 'germanywestcentral' 'italynorth' diff --git a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json index 6c2c8ef68..929c194a7 100644 --- a/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json +++ b/infrastructure/infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.48.1.52935", - "templateHash": "11620463237502199083" + "templateHash": "2730794585217518261" } }, "parameters": { @@ -21,6 +21,7 @@ "centralus", "eastasia", "eastus", + "eastus2", "francecentral", "germanywestcentral", "italynorth", @@ -233,7 +234,7 @@ "roleSearchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7", "roleSearchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0", "cosmosBuiltInDataContributorRoleId": "00000000-0000-0000-0000-000000000002", - "nginxConfTemplate": "worker_processes 1;\r\nerror_log /dev/stderr warn;\r\npid /tmp/nginx.pid;\r\nevents { worker_connections 1024; }\r\nhttp {\r\n include /etc/nginx/mime.types;\r\n default_type application/octet-stream;\r\n access_log /dev/stdout;\r\n proxy_http_version 1.1;\r\n server {\r\n listen 443 ssl;\r\n server_name __FQDN__;\r\n ssl_certificate /mnt/certs/server.crt;\r\n ssl_certificate_key /mnt/certs/server.key;\r\n location /__APIPATH__/ {\r\n proxy_pass https://__MODELHOST__/openai/;\r\n proxy_set_header Host __MODELHOST__;\r\n proxy_ssl_server_name on;\r\n proxy_ssl_name __MODELHOST__;\r\n proxy_ssl_verify on;\r\n proxy_ssl_verify_depth 3;\r\n proxy_ssl_trusted_certificate /etc/pki/tls/certs/ca-bundle.crt;\r\n }\r\n location / { return 200 'gateway-ok'; }\r\n }\r\n}\r\n", + "nginxConfTemplate": "worker_processes 1;\nerror_log /dev/stderr warn;\npid /tmp/nginx.pid;\nevents { worker_connections 1024; }\nhttp {\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n access_log /dev/stdout;\n proxy_http_version 1.1;\n server {\n listen 443 ssl;\n server_name __FQDN__;\n ssl_certificate /mnt/certs/server.crt;\n ssl_certificate_key /mnt/certs/server.key;\n location /__APIPATH__/ {\n proxy_pass https://__MODELHOST__/openai/;\n proxy_set_header Host __MODELHOST__;\n proxy_ssl_server_name on;\n proxy_ssl_name __MODELHOST__;\n proxy_ssl_verify on;\n proxy_ssl_verify_depth 3;\n proxy_ssl_trusted_certificate /etc/pki/tls/certs/ca-bundle.crt;\n }\n location / { return 200 'gateway-ok'; }\n }\n}\n", "nginxConf": "[replace(replace(replace(variables('nginxConfTemplate'), '__FQDN__', variables('customDomainFqdn')), '__APIPATH__', variables('apimApiPath')), '__MODELHOST__', variables('modelHost'))]", "agentAccountBaseProperties": { "allowProjectManagement": true, @@ -439,7 +440,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('foundryModelAccountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -598,7 +599,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2026-11-15-preview", "name": "[variables('foundryAgentAccountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "kind": "AIServices", "tags": "[variables('commonTags')]", "sku": { @@ -681,9 +682,9 @@ }, "dependsOn": [ "[resourceId('Microsoft.Network/privateEndpoints', format('pe-{0}', variables('foundryAgentAccountName')))]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]", "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[0])]", - "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]" + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[1])]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneNames')[2])]" ] }, { diff --git a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf index 2f0c82880..52ae0de41 100644 --- a/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf @@ -138,6 +138,13 @@ resource "azapi_resource" "ai_foundry" { name = "aifoundry${random_string.unique.result}" parent_id = "/subscriptions/${var.subscription_id_resources}/resourceGroups/${var.resource_group_name_resources}" location = coalesce(var.foundry_location, data.azurerm_resource_group.resources.location) + + lifecycle { + precondition { + condition = data.azurerm_resource_group.resources.location == var.location && coalesce(var.foundry_location, data.azurerm_resource_group.resources.location) == var.location + error_message = "The workload resource group, VNet, and Foundry account must all use var.location." + } + } schema_validation_enabled = false body = { @@ -464,7 +471,7 @@ resource "azapi_resource" "conn_aisearch" { ApiType = "Azure" ApiVersion = "2025-05-01-preview" ResourceId = azapi_resource.ai_search.id - location = var.location + location = azapi_resource.ai_search.location } } } diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf index 234d713b3..c00895d83 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf @@ -62,7 +62,7 @@ locals { ## AI Search search_id = local.create_search ? azapi_resource.ai_search[0].id : var.existing_ai_search_id search_name = local.create_search ? azapi_resource.ai_search[0].name : split("/", var.existing_ai_search_id)[8] - search_location = local.create_search ? var.location : data.azapi_resource.existing_search[0].output.location + search_location = local.create_search ? azapi_resource.ai_search[0].location : data.azapi_resource.existing_search[0].output.location ## Fabric (BYO-only, never created — only PE + DNS when workspace ID provided) fabric_name = local.create_fabric ? split("/", var.existing_fabric_workspace_id)[8] : "" diff --git a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf index 3161a3b5e..da813ff05 100644 --- a/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf +++ b/infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf @@ -212,6 +212,13 @@ resource "azapi_resource" "ai_foundry" { name = local.account_name parent_id = local.rg_id location = coalesce(var.foundry_location, local.rg_location) + + lifecycle { + precondition { + condition = local.rg_location == var.location && coalesce(var.foundry_location, local.rg_location) == var.location + error_message = "The workload resource group, VNet, and Foundry account must all use var.location." + } + } schema_validation_enabled = false identity { diff --git a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf index 2da10eb41..31dde0245 100644 --- a/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf +++ b/infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf @@ -43,6 +43,13 @@ resource "azapi_resource" "foundry_agent_account" { parent_id = local.rg_id tags = local.common_tags + lifecycle { + precondition { + condition = coalesce(var.foundry_location, local.create_rg ? azurerm_resource_group.rg[0].location : data.azurerm_resource_group.existing[0].location) == var.location + error_message = "The Foundry account, its injected agent subnet, and the spoke VNet must all use var.location." + } + } + # trustedCertificateSources is a public-preview property that may not be in # the azapi embedded schema; skip client-side validation. schema_validation_enabled = false From b9be901dc5991e2f9451610a02f46f5712604719 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:51:57 -0800 Subject: [PATCH 06/23] Update location parameter for Cognitive Services account Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../infrastructure-setup-bicep/00-basic/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json index 89817a262..d8b8eb940 100644 --- a/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/00-basic/azuredeploy.json @@ -60,7 +60,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, From 25e64c653c4dd10fd19f033b21b0174f462fbdda Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:52:41 -0800 Subject: [PATCH 07/23] Change location to use parameters in azuredeploy.json Updated the location property to use parameters instead of resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../01-connections/ai-gateway-tier/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json index dc34bad02..50dff68e2 100644 --- a/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json @@ -164,7 +164,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "sku": { "name": "S0" }, From a4b8fcfea17dc005d769890f976e14fe6eebe106 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:53:17 -0800 Subject: [PATCH 08/23] Change location parameter for Cognitive Services account Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../infrastructure-setup-bicep/03-custom-dns/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json index b1e31b43b..b35eb9c3f 100644 --- a/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/03-custom-dns/azuredeploy.json @@ -64,7 +64,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, From f82615fe5c0fc0c74dc249cc7c08f7da04ada141 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:53:38 -0800 Subject: [PATCH 09/23] Update location parameter in azuredeploy.json Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../15-private-network-standard-agent-setup/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json index b760640ed..0f27cbf60 100644 --- a/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json @@ -1004,7 +1004,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" From 22acf39673417433932802903d9e359cd90f9c01 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:54:23 -0800 Subject: [PATCH 10/23] Change location value to use parameters Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../15a-private-network-evaluation-only-setup/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json index 645803bf4..1caddb166 100644 --- a/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json @@ -917,7 +917,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" From 3ab71b43b0f308811799006177aa4e7efce429c1 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 21:55:06 -0800 Subject: [PATCH 11/23] Change location value to use parameters for region Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../extensions/ai-gateway-tier-private/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json index 12b2022ca..506f1e957 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json @@ -1267,7 +1267,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('region')]" }, "modelName": { "value": "[parameters('modelName')]" From 5d7d3addff50cb72ba7ccb8b20bedc4ce86719a1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 13 Nov 2026 05:57:16 +0000 Subject: [PATCH 12/23] Preserve account location in generated template Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com> --- .../11-private-network-basic-vnet/main.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json index e4e59e387..0bcbfa24a 100644 --- a/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json +++ b/infrastructure/infrastructure-setup-bicep/11-private-network-basic-vnet/main.json @@ -911,6 +911,9 @@ "accountName": { "value": "[variables('accountName')]" }, + "location": { + "value": "[parameters('location')]" + }, "modelName": { "value": "[parameters('modelName')]" }, @@ -944,6 +947,9 @@ "accountName": { "type": "string" }, + "location": { + "type": "string" + }, "modelName": { "type": "string" }, @@ -972,7 +978,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[parameters('accountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "sku": { "name": "S0" }, From 65f389f429275ee843fdffe2ac29928e03861e8b Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:29:19 -0800 Subject: [PATCH 13/23] Change location value to use parameters for region Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../extensions/ai-gateway-tier-private/main.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json index 12b2022ca..506f1e957 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json @@ -1267,7 +1267,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('region')]" }, "modelName": { "value": "[parameters('modelName')]" From 144e2d6e4d155e5a66e37d9d1613f1a7ddd2af77 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:36:52 -0800 Subject: [PATCH 14/23] Change location value to use parameters Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../45-basic-agent-bing/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json index c3a8fbc11..44009a3a5 100644 --- a/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json @@ -115,7 +115,7 @@ "value": "[variables('account_name')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" From c4d7fba1f1c9f45476261624795b4a6e5ad647d8 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:39:02 -0800 Subject: [PATCH 15/23] Update default region to 'swedencentral' Set default region parameter for AI Gateway tier. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../extensions/ai-gateway-tier-private/main.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep index c95ef615c..a9709bec6 100644 --- a/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep +++ b/infrastructure/infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep @@ -63,7 +63,7 @@ targetScope = 'resourceGroup' 'swedencentral' ]) @description('Region for resources that require the AI Gateway tier and its co-regional VNet.') -param region string = any(resourceGroup().location) +param region string = 'swedencentral' // =========================================================================== // Foundation inputs (template 16 standard network-secured agent) From 0520edc4e7e3fef38bef717d9ab9783c976863e1 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:39:58 -0800 Subject: [PATCH 16/23] Change location value to use parameters Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../18-managed-virtual-network/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json index 818471bc9..b5dec65ec 100644 --- a/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json @@ -769,7 +769,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" From 8360f539f4024976810c3f1951b541fe5e8e7667 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:40:21 -0800 Subject: [PATCH 17/23] Change location parameter for Cognitive Services account Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../20-user-assigned-identity/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json index e4473a158..46d219d99 100644 --- a/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json @@ -141,7 +141,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "UserAssigned", "userAssignedIdentities": { From 9cb0d9fbc27811e2f1c489700f7400a62dbab12d Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:41:09 -0800 Subject: [PATCH 18/23] Change location value to use parameters Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../43-standard-agent-setup-with-customization/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json index ef70a3077..aeed1a480 100644 --- a/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json @@ -557,7 +557,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" } }, "template": { From 7527feaceb61ade0f4f46366703f0e066327be47 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:42:23 -0800 Subject: [PATCH 19/23] Update location parameter in azuredeploy.json Change location parameter to use a specified parameter instead of the resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../30-customer-managed-keys/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json index f3b3a60f1..d83dccffd 100644 --- a/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json @@ -87,7 +87,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-06-01", "name": "[parameters('aiFoundryName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, From bc0d33c37af8be5966bfe4469345757c56d9e9f7 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:42:37 -0800 Subject: [PATCH 20/23] Update location parameter for Cognitive Services account Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../31-customer-managed-keys-standard-agent/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json index 9848ee6b2..a21bf6f89 100644 --- a/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json @@ -144,7 +144,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "sku": { "name": "S0" }, From 2b6d550573c0d19b2c86e6a702639f09fb6abe0a Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:42:50 -0800 Subject: [PATCH 21/23] Change location to use parameters in azuredeploy.json Updated the location property to use parameters instead of resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../40-basic-agent-setup/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json index 9951b4d77..8c14d9fcf 100644 --- a/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json @@ -136,7 +136,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "sku": { "name": "S0" }, From d50c8161c84743f59b40d9fbacdfaf1063a52e14 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:43:08 -0800 Subject: [PATCH 22/23] Change location value to use parameters Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../41-standard-agent-setup/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json index b940e55e9..dcebcc6d5 100644 --- a/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json @@ -554,7 +554,7 @@ "value": "[variables('accountName')]" }, "location": { - "value": "[resourceGroup().location]" + "value": "[parameters('location')]" }, "modelName": { "value": "[parameters('modelName')]" From b97ef2d7d33ad5681fb75cb91a215d20f7e83f30 Mon Sep 17 00:00:00 2001 From: Dennis Eikelenboom <92387505+deeikele@users.noreply.github.com> Date: Thu, 12 Nov 2026 23:43:22 -0800 Subject: [PATCH 23/23] Update location property in azuredeploy.json Changed location property to use parameters instead of resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../42-basic-agent-setup-with-customization/azuredeploy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json index 42c9d2d7b..d7032b140 100644 --- a/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json +++ b/infrastructure/infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json @@ -141,7 +141,7 @@ "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2025-04-01-preview", "name": "[variables('accountName')]", - "location": "[resourceGroup().location]", + "location": "[parameters('location')]", "sku": { "name": "S0" },