Skip to content

Commit 0afd825

Browse files
AlexanderSehreriqua
AlexanderSehr
and
eriqua
authored
[Modules] Congnitive Services: Set secure defaults (#1483)
* Fixed readme * Flipped image build deployment * Undid param change * Implemented --no-restore for workaround * Regenerated readme * Draft for cognitive services cmk * Removed CMK implementation as its currently not fully working & Set secure defaults * Added encryption test * Added docs * Updated readme * Updated metadata * Shuffle * Minor update * Minor update * Update arm/Microsoft.CognitiveServices/accounts/readme.md Co-authored-by: Erika Gressi <56914614+eriqua@users.noreply.github.com> * Update arm/Microsoft.CognitiveServices/accounts/deploy.bicep Co-authored-by: Erika Gressi <56914614+eriqua@users.noreply.github.com> * Adjusted network access default * Update to latest * Updated readme * Updated param * Adjusted default * Minor fix * Updated readme Co-authored-by: Erika Gressi <56914614+eriqua@users.noreply.github.com>
1 parent bf5c093 commit 0afd825

8 files changed

Lines changed: 284 additions & 32 deletions

File tree

‎.azuredevops/modulePipelines/ms.cognitiveservices.accounts.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ stages:
4747
deploymentBlocks:
4848
- path: $(modulePath)/.parameters/parameters.json
4949
- path: $(modulePath)/.parameters/speech.parameters.json
50+
- path: $(modulePath)/.parameters/encr.parameters.json
51+
- path: $(modulePath)/.parameters/min.parameters.json
5052

5153
- stage: Publishing
5254
displayName: Publishing

‎arm/Microsoft.CognitiveServices/accounts/.parameters/encr.parameters.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"name": {
6+
"value": "<<namePrefix>>-az-cgs-encr-001"
7+
},
8+
"kind": {
9+
"value": "SpeechServices"
10+
},
11+
"sku": {
12+
"value": "S0"
13+
},
14+
"userAssignedIdentities": {
15+
"value": {
16+
"/subscriptions/<<subscriptionId>>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<<namePrefix>>-az-msi-x-001": {}
17+
}
18+
},
19+
"publicNetworkAccess": {
20+
"value": "Enabled"
21+
},
22+
"encryption": {
23+
"value": {
24+
"keySource": "Microsoft.KeyVault",
25+
"keyVaultProperties": {
26+
"identityClientId": "c907a696-36f4-49fe-b926-39e3aabba814", // ID must be updated for new identity
27+
"keyVaultUri": "https://adp-<<namePrefix>>-az-kv-nopr-002.vault.azure.net/",
28+
"keyName": "keyEncryptionKey",
29+
"keyversion": "4570a207ec394a0bbbe4fc9adc663a51" // Version must be updated for new keys
30+
}
31+
}
32+
}
33+
}
34+
}

‎arm/Microsoft.CognitiveServices/accounts/.parameters/min.parameters.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"name": {
6+
"value": "<<namePrefix>>-az-cgs-min-001"
7+
},
8+
"kind": {
9+
"value": "SpeechServices"
10+
}
11+
}
12+
}

‎arm/Microsoft.CognitiveServices/accounts/.parameters/parameters.json‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"value": "Face"
1313
},
1414
"sku": {
15-
"value": "F0"
15+
"value": "S0"
1616
},
1717
"roleAssignments": {
1818
"value": [
@@ -24,6 +24,20 @@
2424
}
2525
]
2626
},
27+
"networkAcls": {
28+
"value": {
29+
"defaultAction": "deny",
30+
"virtualNetworkRules": [
31+
{
32+
"id": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-001",
33+
"action": "Allow"
34+
}
35+
]
36+
}
37+
},
38+
"customSubDomainName": {
39+
"value": "<<namePrefix>>xdomain"
40+
},
2741
"systemAssignedIdentity": {
2842
"value": true
2943
},

‎arm/Microsoft.CognitiveServices/accounts/.parameters/speech.parameters.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"value": "SpeechServices"
1010
},
1111
"sku": {
12-
"value": "F0"
12+
"value": "S0"
1313
},
1414
"systemAssignedIdentity": {
1515
"value": true
@@ -20,7 +20,7 @@
2020
}
2121
},
2222
"customSubDomainName": {
23-
"value": "<<namePrefix>>domain"
23+
"value": "<<namePrefix>>speechdomain"
2424
},
2525
"privateEndpoints": {
2626
"value": [

‎arm/Microsoft.CognitiveServices/accounts/deploy.bicep‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
@description('Required. The name of Cognitive Services account.')
22
param name string
33

4-
@description('Required. Kind of the Cognitive Services. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'sku\' for your Azure region.')
4+
@description('Required. Kind of the Cognitive Services. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
55
@allowed([
66
'AnomalyDetector'
77
'Bing.Autosuggest.v7'
@@ -28,7 +28,7 @@ param name string
2828
])
2929
param kind string
3030

31-
@description('Optional. SKU of the Cognitive Services resource. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'sku\' for your Azure region.')
31+
@description('Optional. SKU of the Cognitive Services resource. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
3232
@allowed([
3333
'C2'
3434
'C3'
@@ -70,23 +70,24 @@ param diagnosticEventHubAuthorizationRuleId string = ''
7070
@description('Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category.')
7171
param diagnosticEventHubName string = ''
7272

73-
@description('Conditional. Subdomain name used for token-based authentication. Required if \'networkAcls\' are set.')
73+
@description('Conditional. Subdomain name used for token-based authentication. Required if \'networkAcls\' or \'privateEndpoints\' are set.')
7474
param customSubDomainName string = ''
7575

7676
@description('Optional. Whether or not public endpoint access is allowed for this account.')
7777
@allowed([
78+
''
7879
'Enabled'
7980
'Disabled'
8081
])
81-
param publicNetworkAccess string = 'Enabled'
82+
param publicNetworkAccess string = ''
8283

8384
@description('Optional. Service endpoint object information.')
8485
param networkAcls object = {}
8586

8687
@description('Optional. Enables system assigned managed identity on the resource.')
8788
param systemAssignedIdentity bool = false
8889

89-
@description('Optional. The ID(s) to assign to the resource.')
90+
@description('Conditional. The ID(s) to assign to the resource. Required if a user assigned identity is used for encryption.')
9091
param userAssignedIdentities object = {}
9192

9293
@allowed([
@@ -112,8 +113,8 @@ param allowedFqdnList array = []
112113
@description('Optional. The API properties for special APIs.')
113114
param apiProperties object = {}
114115

115-
@description('Optional. Allow only Azure AD authentication.')
116-
param disableLocalAuth bool = false
116+
@description('Optional. Allow only Azure AD authentication. Should be enabled for security reasons.')
117+
param disableLocalAuth bool = true
117118

118119
@description('Optional. Properties to configure encryption.')
119120
param encryption object = {}
@@ -182,12 +183,6 @@ var identity = identityType != 'None' ? {
182183
userAssignedIdentities: !empty(userAssignedIdentities) ? userAssignedIdentities : null
183184
} : null
184185

185-
var networkAcls_var = {
186-
defaultAction: !empty(networkAcls) ? networkAcls.defaultAction : null
187-
virtualNetworkRules: !empty(networkAcls) ? ((length(networkAcls.virtualNetworkRules) == 0) ? [] : networkAcls.virtualNetworkRules) : null
188-
ipRules: !empty(networkAcls) ? ((length(networkAcls.ipRules) == 0) ? [] : networkAcls.ipRules) : null
189-
}
190-
191186
resource defaultTelemetry 'Microsoft.Resources/deployments@2021-04-01' = if (enableDefaultTelemetry) {
192187
name: 'pid-47ed15a6-730a-4827-bcb4-0fd963ffbd82-${uniqueString(deployment().name, location)}'
193188
properties: {
@@ -211,8 +206,8 @@ resource cognitiveServices 'Microsoft.CognitiveServices/accounts@2021-10-01' = {
211206
}
212207
properties: {
213208
customSubDomainName: !empty(customSubDomainName) ? customSubDomainName : null
214-
networkAcls: !empty(networkAcls) ? networkAcls_var : null
215-
publicNetworkAccess: publicNetworkAccess
209+
networkAcls: networkAcls
210+
publicNetworkAccess: !empty(publicNetworkAccess) ? any(publicNetworkAccess) : (!empty(privateEndpoints) ? 'Disabled' : null)
216211
allowedFqdnList: allowedFqdnList
217212
apiProperties: apiProperties
218213
disableLocalAuth: disableLocalAuth

0 commit comments

Comments
 (0)