@@ -105,8 +105,9 @@ resource "azapi_resource" "storage" {
105105}
106106
107107# AI Foundry account (preview) using AzAPI provider.
108+ # Using managed identity authentication (disableLocalAuth = true for better security)
108109resource "azapi_resource" "ai_foundry" {
109- type = " Microsoft.CognitiveServices/accounts@2025-06 -01"
110+ type = " Microsoft.CognitiveServices/accounts@2024-10 -01"
110111 name = . ai_foundry_name
111112 location = . location
112113 parent_id = . rg . id
@@ -118,7 +119,7 @@ resource "azapi_resource" "ai_foundry" {
118119 properties = {
119120 allowProjectManagement = true
120121 customSubDomainName = local.ai_foundry_name
121- disableLocalAuth = false
122+ disableLocalAuth = true
122123 }
123124 })
124125}
@@ -446,24 +447,21 @@ resource "azurerm_linux_web_app" "app" {
446447 DOCKER_ENABLE_CI = " true"
447448 WEBSITES_PORT = " 8000"
448449
449- # GPT Configuration (Key Vault referenced secrets )
450+ # GPT Configuration (using managed identity )
450451 gpt_endpoint = " https://${ local . ai_foundry_name } .cognitiveservices.azure.com/"
451452 gpt_deployment = " gpt-4o-mini"
452- gpt_api_key = " @Microsoft.KeyVault(SecretUri=${ azurerm_key_vault . kv . vault_uri } secrets/ai-foundry-key)"
453453 gpt_api_version = " 2024-12-01-preview"
454454
455- # MSFT Foundry Configuration
455+ # MSFT Foundry Configuration (using managed identity)
456456 AZURE_AI_FOUNDRY_ENDPOINT = " https://${ local . ai_foundry_name } .cognitiveservices.azure.com/"
457457 AZURE_AI_PROJECT_NAME = local.ai_project_name
458458 AZURE_AI_PROJECT_ENDPOINT = " https://${ local . ai_foundry_name } .cognitiveservices.azure.com/"
459459 AZURE_AI_AGENT_MODEL_DEPLOYMENT_NAME = " gpt-4o-mini"
460- AZURE_AI_FOUNDRY_API_KEY = " @Microsoft.KeyVault(SecretUri=${ azurerm_key_vault . kv . vault_uri } secrets/ai-foundry-key)"
461460
462- # MSFT Foundry OpenAI Configuration
461+ # MSFT Foundry OpenAI Configuration (using managed identity)
463462 AZURE_OPENAI_CHAT_DEPLOYMENT = " gpt-4o-mini"
464463 AZURE_OPENAI_EMBEDDING_DEPLOYMENT = " text-embedding-3-small"
465464 AZURE_OPENAI_IMAGE_DEPLOYMENT = " dall-e-3"
466- AZURE_OPENAI_API_KEY = " @Microsoft.KeyVault(SecretUri=${ azurerm_key_vault . kv . vault_uri } secrets/ai-foundry-key)"
467465 AZURE_OPENAI_ENDPOINT = " https://${ local . ai_foundry_name } .cognitiveservices.azure.com/"
468466 AZURE_OPENAI_API_VERSION = " 2024-02-01"
469467
@@ -537,14 +535,9 @@ resource "azurerm_key_vault_access_policy" "app_policy" {
537535 depends_on = azurerm_linux_web_app . app ]
538536}
539537
540- # Populate Key Vault secrets (AI Foundry key, Cosmos key, Search key, Storage connection)
538+ # Populate Key Vault secrets (Cosmos key, Search key, Storage connection)
541539# Key Vault Secrets as Terraform resources (provides version for references)
542- resource "azurerm_key_vault_secret" "ai_foundry_key" {
543- name = " ai-foundry-key"
544- value = jsondecode (data. azapi_resource_action . ai_foundry_keys [0 ]. output ). key1
545- key_vault_id = . kv . id
546- depends_on = azurerm_key_vault . kv ]
547- }
540+ # Note: AI Foundry now uses managed identity instead of keys
548541
549542resource "azurerm_key_vault_secret" "search_admin_key" {
550543 name = " search-admin-key"
@@ -925,6 +918,23 @@ resource "azurerm_role_assignment" "search_project_contributor" {
925918 principal_type = " ServicePrincipal"
926919}
927920
921+ # Role assignments for Web App managed identity to access AI Foundry
922+ resource "azurerm_role_assignment" "webapp_foundry_openai_user" {
923+ scope = . ai_foundry . id
924+ role_definition_id = " /subscriptions/${ data . azurerm_client_config . current . subscription_id } /providers/Microsoft.Authorization/roleDefinitions/${ local . cognitive_openai_user_role_id } "
925+ principal_id = . azurerm_linux_web_app . app_identity . identity [0 ]. principal_id
926+ principal_type = " ServicePrincipal"
927+ depends_on = azurerm_linux_web_app . app ]
928+ }
929+
930+ resource "azurerm_role_assignment" "webapp_project_openai_user" {
931+ scope = . ai_project . id
932+ role_definition_id = " /subscriptions/${ data . azurerm_client_config . current . subscription_id } /providers/Microsoft.Authorization/roleDefinitions/${ local . cognitive_openai_user_role_id } "
933+ principal_id = . azurerm_linux_web_app . app_identity . identity [0 ]. principal_id
934+ principal_type = " ServicePrincipal"
935+ depends_on = azurerm_linux_web_app . app ]
936+ }
937+
928938# Storage account permissions for MSFT Foundry project
929939resource "azurerm_role_assignment" "storage_blob_data_contributor_user" {
930940 scope = . storage . id
@@ -1099,16 +1109,7 @@ data "azapi_resource_action" "cosmos_keys" {
10991109 depends_on = azurerm_cosmosdb_account . cosmos ]
11001110}
11011111
1102- # Get AI Foundry keys for Web App configuration
1103- data "azapi_resource_action" "ai_foundry_keys" {
1104- count = . enable_ai_automation ? 1 : 0
1105- type = " Microsoft.CognitiveServices/accounts@2024-10-01"
1106- resource_id = . ai_foundry . id
1107- action = " listKeys"
1108- response_export_values = " key1"
1109- body = jsonencode ({})
1110- depends_on = azapi_resource . ai_foundry ]
1111- }
1112+ # AI Foundry now uses managed identity authentication - no keys needed
11121113
11131114# Connect resources to MSFT Foundry project using ARM templates
11141115resource "azapi_resource" "storage_connection" {
0 commit comments