diff --git a/quickstart/101-machine-learning/compute.tf b/quickstart/101-machine-learning/compute.tf index fc65a7d6..3db218f0 100644 --- a/quickstart/101-machine-learning/compute.tf +++ b/quickstart/101-machine-learning/compute.tf @@ -13,6 +13,7 @@ resource "azurerm_machine_learning_compute_cluster" "compute" { machine_learning_workspace_id = azurerm_machine_learning_workspace.default.id vm_priority = "Dedicated" vm_size = "STANDARD_DS2_V2" + identity { type = "SystemAssigned" } diff --git a/quickstart/101-machine-learning/workspace.tf b/quickstart/101-machine-learning/workspace.tf index d0499258..facea4a1 100644 --- a/quickstart/101-machine-learning/workspace.tf +++ b/quickstart/101-machine-learning/workspace.tf @@ -13,7 +13,7 @@ resource "azurerm_key_vault" "default" { tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "premium" purge_protection_enabled = true - + network_acls { default_action = "Deny" bypass = "AzureServices" @@ -46,7 +46,7 @@ resource "azurerm_machine_learning_workspace" "default" { key_vault_id = azurerm_key_vault.default.id storage_account_id = azurerm_storage_account.default.id container_registry_id = azurerm_container_registry.default.id - + identity { type = "SystemAssigned" } diff --git a/quickstart/201-machine-learning-moderately-secure/network.tf b/quickstart/201-machine-learning-moderately-secure/network.tf index 1fbbf6f1..c1751545 100644 --- a/quickstart/201-machine-learning-moderately-secure/network.tf +++ b/quickstart/201-machine-learning-moderately-secure/network.tf @@ -121,6 +121,7 @@ resource "azurerm_network_security_group" "nsg-training" { source_address_prefix = "BatchNodeManagement" destination_address_prefix = "*" } + security_rule { name = "AzureMachineLearning" priority = 110 @@ -152,7 +153,7 @@ resource "azurerm_subnet_network_security_group_association" "nsg-aks-link" { # User Defined Routes -# UDR for Compute instance and compute clusters +# UDR for compute instance and compute clusters resource "azurerm_route_table" "rt-training" { name = "rt-training" location = azurerm_resource_group.default.location diff --git a/quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf b/quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf index 73caea14..09c6a8bc 100644 --- a/quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf +++ b/quickstart/202-machine-learning-moderately-secure-existing-VNet/network.tf @@ -1,5 +1,4 @@ # Network Security Groups - resource "azurerm_network_security_group" "nsg-training" { name = "nsg-training" location = azurerm_resource_group.default.location @@ -16,6 +15,7 @@ resource "azurerm_network_security_group" "nsg-training" { source_address_prefix = "BatchNodeManagement" destination_address_prefix = "*" } + security_rule { name = "AzureMachineLearning" priority = 110 @@ -49,7 +49,7 @@ resource "azurerm_subnet_network_security_group_association" "nsg-aks-link" { # User Defined Routes -#UDR for Compute instance and compute clusters +# UDR for Compute instance and compute clusters resource "azurerm_route_table" "rt-training" { name = "rt-training" location = azurerm_resource_group.default.location @@ -84,8 +84,8 @@ resource "azurerm_subnet_route_table_association" "rt-training-link" { subnet_id = var.training_subnet_resource_id route_table_id = azurerm_route_table.rt-training.id } -# Inferencing (AKS) Route +# Inferencing (AKS) Route resource "azurerm_route_table" "rt-aks" { name = "rt-aks" location = azurerm_resource_group.default.location diff --git a/quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf b/quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf index bd1ff762..894d03f8 100644 --- a/quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf +++ b/quickstart/202-machine-learning-moderately-secure-existing-VNet/variables.tf @@ -21,7 +21,6 @@ variable "image_build_compute_name" { } # Existing subnets variables - variable "training_subnet_resource_id" { type = string description = "Resource ID of the existing training subnet" @@ -39,7 +38,6 @@ variable "ml_subnet_resource_id" { # Existing private DNS zones variables - variable "privatelink_api_azureml_ms_resource_id" { type = string description = "Resource ID of the existing privatelink.api.azureml.ms private dns zone" diff --git a/quickstart/301-machine-learning-highly-secure/readme.md b/quickstart/301-machine-learning-highly-secure/readme.md deleted file mode 100644 index 5d0dfcad..00000000 --- a/quickstart/301-machine-learning-highly-secure/readme.md +++ /dev/null @@ -1,44 +0,0 @@ -# Azure Machine Learning workspace (highly secure network set up) - -This deployment configuration specifies an [Azure Machine Learning workspace](https://docs.microsoft.com/en-us/azure/machine-learning/concept-workspace), -and its associated resources including Azure Key Vault, Azure Storage, Azure Application Insights and Azure Container Registry. - -In addition to these core services, this configuration specifies any networking components that are required to set up Azure Machine Learning -for private network connectivity using [Azure Private Link](https://docs.microsoft.com/en-us/azure/private-link/). - -This configuration describes the minimal set of resources you require to get started with Azure Machine Learning in a network-isolated set-up. - -To learn more about security configurations in Azure Machine Learning, see [Enterprise security and governance for Azure Machine Learning](https://docs.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security). - -## Resources - -| Terraform Resource Type | Description | -| - | - | -| `azurerm_resource_group` | The resource group all resources get deployed into | -| `azurerm_application_insights` | An Azure Application Insights instance associated to the Azure Machine Learning workspace | -| `azurerm_key_vault` | An Azure Key Vault instance associated to the Azure Machine Learning workspace | -| `azurerm_storage_account` | An Azure Storage instance associated to the Azure Machine Learning workspace | -| `azurerm_container_registry` | An Azure Container Registry instance associated to the Azure Machine Learning workspace | -| `azurerm_machine_learning_workspace` | An Azure Machine Learning workspace instance | -| `azurerm_virtual_network` | An Azure Machine Learning workspace instance | -| `azurerm_subnet` | An Azure Machine Learning workspace instance | -| `azurerm_private_dns_zone` | Private DNS Zones for FQDNs required for Azure Machine Learning and associated resources | -| `azurerm_private_dns_zone_virtual_network_link` | Virtual network links of the Private DNS Zones to the virtual network resource | -| `azurerm_private_endpoint` | Private Endpoints for the Azure Machine Learning workspace and associated resources | - -## Variables - -| Name | Description | -|-|-| -| name | Name of the deployment | -| environment | The deployment environment name (used for pre- and postfixing resource names) | -| location | The Azure region used for deployments | - - -## Usage - -```bash -terraform plan -var name=azureml567 -out demo.tfplan - -terraform apply "demo.tfplan" -```