Azure OpenAI Landingzone using Terraform

adding Azure Open AI landing zone

quickstart/301-AzureAIServicesLandingZone/.gitignore

@@ -0,0 +1,77 @@
+# Variable files
+terraform.tfvars
+
+### https://raw.github.com/github/gitignore/abad92dac5a4306f72242dae3bca6e277bce3615/Terraform.gitignore
+
+# Compiled files
+*.tfstate
+*.tfstate.backup
+*.tfvars
+*.tfstate*
+
+**/.terraform.lock.hcl
+
+# Terraform directory
+.terraform/
+terraform.tfstate.d/
+logs/
+
+# Go vendor directory
+vendor/
+
+# Files generated by terratest
+.test-data/
+
+# Terraform log file
+terraform.log
+
+### https://raw.github.com/github/gitignore/abad92dac5a4306f72242dae3bca6e277bce3615/Global/Vim.gitignore
+
+# swap
+[._]*.s[a-w][a-z]
+[._]s[a-w][a-z]
+# session
+Session.vim
+# temporary
+.netrwhist
+*~
+# auto-generated tag files
+tags
+
+# IDE configs
+.idea
+
+# Ruby download package lock file.
+Gemfile.lock
+
+# Mac folder attribute file
+.DS_Store
+
+.terraform.tfstate.lock.info
+
+# SSH Key
+private_ssh_key
+
+# generated readme by the pr-check job
+
+README-generated.md
+
+**/override.tf
+
+.tflint.hcl
+.tflint_example.hcl
+
+tfmod-scaffold/
+scripts
+
+test/go.sum
+
+TestRecord/
+**/TestRecord.md.tmp
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Ignore Visual Studio Json files
+.vs

quickstart/301-AzureAIServicesLandingZone/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Freddy Ayala
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

quickstart/301-AzureAIServicesLandingZone/Landing_Zone/connectivity.dns.privatelink.tf

@@ -0,0 +1,36 @@
+module "private_link_dns_integration" {
+
+  source                       = "../Modules/Core/DNS/azure-private-endpoint-dns-integration"
+  location                     = var.location
+  resource_group_dns_name      = module.connectivity.dns_resource_group_name
+  user_assigned_identity_name  = "dns-remediation-managed-identity"
+  scope_management_group       = var.scope_management_group
+  deny_prive_dns_zone_creation = false
+  json_policies_file           = "${path.module}/private-zones.json"
+  depends_on                   = [module.connectivity]
+  providers = {
+    azurerm = azurerm.connectivity
+  }
+
+}
+
+
+resource "azurerm_private_dns_zone_virtual_network_link" "example" {
+  name                  = "open-ai-link"
+  resource_group_name   = module.connectivity.dns_resource_group_name
+  private_dns_zone_name = "privatelink.openai.azure.com"
+  virtual_network_id    = values(values(module.connectivity.module.azurerm_virtual_network)[0])[0].id
+  depends_on = [ module.private_link_dns_integration ]
+  provider =  azurerm.connectivity
+
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "cognitive" {
+  name                  = "cognitive-services-link"
+  resource_group_name   = module.connectivity.dns_resource_group_name
+  private_dns_zone_name = "privatelink.cognitiveservices.azure.com"
+  virtual_network_id    = values(values(module.connectivity.module.azurerm_virtual_network)[0])[0].id
+  depends_on = [ module.private_link_dns_integration ]
+  provider =  azurerm.connectivity
+
+}

quickstart/301-AzureAIServicesLandingZone/Landing_Zone/connectivity.firewalls.rules.tf

@@ -0,0 +1,95 @@
+resource "azurerm_firewall_policy_rule_collection_group" "example" {
+
+  firewall_policy_id = values(values(module.connectivity.module.azurerm_firewall_policy)[0])[0].id
+
+
+  for_each = local.firewall_rule_collection_groups
+  name     = format("fwrcg-%s", each.key)
+  priority = each.value.priority
+
+  dynamic "network_rule_collection" {
+    iterator = self
+    for_each = each.value.network_rule_collections
+    content {
+      name     = format("nrc-%s", self.key)
+      priority = self.value.priority
+      action   = self.value.action
+      dynamic "rule" {
+        for_each = self.value.rules
+        content {
+          name              = rule.key
+          protocols         = rule.value.protocols
+          destination_ports = rule.value.destination_ports
+
+          destination_addresses = rule.value.destination_addresses
+          destination_ip_groups = rule.value.destination_ip_groups
+          destination_fqdns     = rule.value.destination_fqdns
+
+          source_addresses = rule.value.source_addresses
+          source_ip_groups = rule.value.source_ip_groups
+        }
+      }
+    }
+  }
+
+  dynamic "application_rule_collection" {
+    iterator = self
+    for_each = each.value.application_rule_collections
+
+    content {
+      name     = format("arc-%s", self.key)
+      priority = self.value.priority
+      action   = self.value.action
+      dynamic "rule" {
+        for_each = lookup(self.value, "rules", {})
+        content {
+          name = rule.key
+
+          destination_fqdns     = rule.value.destination_fqdns
+          //destination_fqdn_tags = rule.value.destination_fqdn_tags
+
+          source_addresses = rule.value.source_addresses
+          source_ip_groups = rule.value.source_ip_groups
+
+          terminate_tls = false
+          dynamic "protocols" {
+            for_each = rule.value.protocols
+            content {
+              type = protocols.value.type
+              port = protocols.value.port
+            }
+          }
+        }
+      }
+    }
+  }
+
+  dynamic "nat_rule_collection" {
+    iterator = self
+    for_each = each.value.nat_rule_collections
+    content {
+      name     = format("natrc-%s", self.key)
+      priority = self.value.priority
+      action   = "Dnat"
+      dynamic "rule" {
+        for_each = lookup(self.value, "rules", {})
+        content {
+          name      = rule.key
+          protocols = rule.value.protocols
+
+          destination_address = rule.value.destination_address
+          destination_ports   = rule.value.destination_ports
+          translated_address  = rule.value.translated_address
+          translated_port     = rule.value.translated_port
+
+          source_addresses = rule.value.source_addresses
+          source_ip_groups = rule.value.source_ip_groups
+        }
+      }
+    }
+  }
+provider = azurerm.connectivity
+
+}
+
+

quickstart/301-AzureAIServicesLandingZone/Landing_Zone/connectivity/bastion.tf

@@ -0,0 +1,103 @@
+# Azure Bastion
+
+resource "azurerm_public_ip" "lz-pip-bastion" {
+  name                = "lz-pip-bastion"
+  location            = var.location
+  resource_group_name = values(values(module.enterprise_scale.azurerm_firewall)[0])[0].resource_group_name
+  allocation_method   = "Static"
+  sku                 = "Standard"
+
+
+}
+
+resource "azurerm_bastion_host" "lz-bastion-host" {
+  name                = "lz-bastion-host"
+  location            = var.location
+  resource_group_name = values(values(module.enterprise_scale.azurerm_firewall)[0])[0].resource_group_name
+
+
+  ip_configuration {
+    name                 = "configuration"
+    subnet_id            = values(values(module.enterprise_scale.azurerm_subnet.connectivity)[0])[4]
+    public_ip_address_id = azurerm_public_ip.lz-pip-bastion.id
+  }
+
+  depends_on=["module.enterprise_scale"]
+}
+
+
+
+
+resource "azurerm_network_security_group" "bastion-nsg" {
+  name                = "lz-nsg-hub-bastion"
+  resource_group_name = values(values(module.enterprise_scale.azurerm_firewall)[0])[0].resource_group_name
+  location            = var.location
+  security_rule {
+    name                       = "GatewayManager"
+    priority                   = 1001
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "443"
+    source_address_prefix      = "GatewayManager"
+    destination_address_prefix = "*"
+  }
+
+  security_rule {
+    name                       = "Internet-Bastion-PublicIP"
+    priority                   = 1002
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "443"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+
+  security_rule {
+    name                       = "OutboundVirtualNetwork"
+    priority                   = 1001
+    direction                  = "Outbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_ranges    = ["22", "3389"]
+    source_address_prefix      = "*"
+    destination_address_prefix = "VirtualNetwork"
+  }
+
+  security_rule {
+    name                       = "OutboundToAzureCloud"
+    priority                   = 1002
+    direction                  = "Outbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "443"
+    source_address_prefix      = "*"
+    destination_address_prefix = "AzureCloud"
+  }
+
+  /*security_rule {
+
+    name                       = "OutboundToOnPrem"
+    priority                   = 1003
+    direction                  = "Outbound"
+    access                     = "Allow"
+    protocol                   = "*"
+    source_port_range          = "*"
+    destination_port_range     = "*"
+    source_address_prefix      = "*"
+    destination_address_prefixes = var.local_gateway_address_space
+  }*/
+
+}
+
+resource "azurerm_subnet_network_security_group_association" "example" {
+  subnet_id                 = values(values(module.enterprise_scale.azurerm_subnet.connectivity)[0])[4]
+  network_security_group_id = azurerm_network_security_group.bastion-nsg.id
+
+}
+

quickstart/301-AzureAIServicesLandingZone/Landing_Zone/connectivity/dns.tf

@@ -0,0 +1,32 @@
+module "private_dns_resolver" {
+
+  source                    = "../../Modules/Core/DNS/private_dns_resolver"
+  location                  = var.location
+  inbound_subnet_name       = "inboundsubnetdns"
+  outbound_subnet_name      = "outboundsubnetdns"
+  virtual_network_id        = values(values(module.enterprise_scale.azurerm_virtual_network)[0])[0].id
+  virtual_network_name      = values(values(module.enterprise_scale.azurerm_virtual_network)[0])[0].name
+  resource_group_name       = values(values(module.enterprise_scale.azurerm_firewall)[0])[0].resource_group_name
+  private_dns_resolver_name = "dns-priv-resolver"
+  inbound_endpoint_name     = "inboundsubnetdns"
+  outbound_endpoint_name    = "outboundsubnetdns"
+  forwarding_rulesets = [
+    {
+      name = "rls-lz"
+      forwarding_rules = [
+        {
+          name        = "google-com"
+          domain_name = "google.com."
+          target_dns_servers = [
+            {
+              ip_address = "8.8.8.8"
+              port       = 53
+            }
+          ]
+        },
+  ] }]
+
+  depends_on = [module.enterprise_scale]
+
+
+}