ezwiefel / aml-bicep-quickstart Goto Github PK

We need to check Azure Quickstart repo bicep best practices in order to be able to merge the example into master. When creating a pull request there will be an automated check that is ran.

Make a copy of the 201 template and remove all private link endpoint and DNS related components to come with a lean Bicep example for workspace, compute and dependent resources.

Bastion is currently deployed in the VNET file, but it is a long deploying resource that holds up other deployments. If it is a separate file, then it'll should speed up the deployment.

Add @description decorators for all of the parameters in the modules.

Include proper default values for each resource. For example, for the workspace resource, we need to include display_name, description to indicate how they should be used. For private link workspaces, we should set image_build_compute and public_mode_enabled to the CPU cluster that comes with the workspace.

Private AKS deployment started failing with the following error:

{
    "status": "Failed",
    "error": {
        "code": "BadRequest",
        "message": The subnet has a network security group (/subscriptions/[subid]/resourceGroups/[rg-name]/providers/Microsoft.Network/networkSecurityGroups/nsg-amlws-hlew) that is missing the following rules below. Please add those rules or increase the prioriy to allow traffic if the rules already exist. 
                    {
                    "name": "Outbound_MicrosoftContainerRegistry",
                    "properties": {
                        "protocol": "TCP",
                        "sourcePortRange": "*",
                        "destinationPortRange": "443",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "MicrosoftContainerRegistry",
                        "priority": "Higher than 65500",
                        "direction": "Outbound"
                    }
                    }
    }
}

Just thoughts here... it might make sense to have the compute resources deployed from the top-level file - since these aren't strictly required in the workspace.

We should consider adding conditionals for the submodules - so if you don't want Bastion deployed, want to use your own VNET, etc. then it could be parameter changes to main.bicep instead of editing the whole repo structure.