Skip to content

Commit d83fda1

Browse files
Avijit-MicrosoftAvijit-Microsoft
authored
feat: process KM sample data manually as part of post-deployment activity
feat: process KM sample data manually as part of post-deployment activity
2 parents aafbe22 + 52d5a53 commit d83fda1

12 files changed

Lines changed: 323 additions & 198 deletions

‎azure.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,17 @@ hooks:
1414
run: |
1515
Write-Host "Web app URL: "
1616
Write-Host "$env:WEB_APP_URL" -ForegroundColor Cyan
17+
Write-Host "✅ If you want to use the Sample Data, run the following command in the Bash terminal to process it:"
18+
./infra/scripts/process_sample_data.sh <storage_account_name> <storage_container_name> <managed_client_id> <key_vault_name> <sql_server_name> <sql_database_name> <resource_group_name>
1719
shell: pwsh
1820
continueOnError: false
1921
interactive: true
2022
posix:
2123
run: |
2224
echo "Web app URL: "
2325
echo $WEB_APP_URL
26+
echo "✅ If you want to use the Sample Data, run the following command in the Bash terminal to process it:"
27+
./infra/scripts/process_sample_data.sh <storage_account_name> <storage_container_name> <managed_client_id> <key_vault_name> <sql_server_name> <sql_database_name> <resource_group_name>
2428
shell: sh
2529
continueOnError: false
2630
interactive: true

‎infra/deploy_post_deployment_scripts.bicep‎

Lines changed: 0 additions & 93 deletions
This file was deleted.

‎infra/main.bicep‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -157,29 +157,34 @@ resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
157157
}
158158

159159
//========== Deployment script to upload sample data ========== //
160-
module uploadFiles 'deploy_post_deployment_scripts.bicep' = {
161-
name : 'deploy_post_deployment_scripts'
162-
params:{
163-
solutionName: solutionPrefix
164-
solutionLocation: secondaryLocation
165-
baseUrl: baseUrl
166-
storageAccountName: storageAccount.outputs.storageName
167-
containerName: storageAccount.outputs.storageContainer
168-
managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
169-
managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
170-
keyVaultName:aifoundry.outputs.keyvaultName
171-
logAnalyticsWorkspaceResourceName: aifoundry.outputs.logAnalyticsWorkspaceResourceName
172-
sqlServerName: sqlDBModule.outputs.sqlServerName
173-
sqlDbName: sqlDBModule.outputs.sqlDbName
174-
sqlUsers: [
175-
{
176-
principalId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId // Replace with actual Principal ID
177-
principalName: managedIdentityModule.outputs.managedIdentityBackendAppOutput.name // Replace with actual user email or name
178-
databaseRoles: ['db_datareader', 'db_datawriter']
179-
}
180-
]
181-
}
182-
}
160+
// module uploadFiles 'deploy_post_deployment_scripts.bicep' = {
161+
// name : 'deploy_post_deployment_scripts'
162+
// params:{
163+
// solutionName: solutionPrefix
164+
// solutionLocation: secondaryLocation
165+
// baseUrl: baseUrl
166+
// storageAccountName: storageAccount.outputs.storageName
167+
// containerName: storageAccount.outputs.storageContainer
168+
// managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
169+
// managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
170+
// keyVaultName:aifoundry.outputs.keyvaultName
171+
// logAnalyticsWorkspaceResourceName: aifoundry.outputs.logAnalyticsWorkspaceResourceName
172+
// sqlServerName: sqlDBModule.outputs.sqlServerName
173+
// sqlDbName: sqlDBModule.outputs.sqlDbName
174+
// sqlUsers: [
175+
// {
176+
// principalId: managedIdentityModule.outputs.managedIdentityChartsOutput.clientId // Replace with actual Principal ID
177+
// principalName: managedIdentityModule.outputs.managedIdentityChartsOutput.name // Replace with actual user email or name
178+
// databaseRoles: ['db_datareader', 'db_datawriter']
179+
// }
180+
// {
181+
// principalId: managedIdentityModule.outputs.managedIdentityRagOutput.clientId // Replace with actual Principal ID
182+
// principalName: managedIdentityModule.outputs.managedIdentityRagOutput.name // Replace with actual user email or name
183+
// databaseRoles: ['db_datareader']
184+
// }
185+
// ]
186+
// }
187+
// }
183188

184189
module hostingplan 'deploy_app_service_plan.bicep' = {
185190
name: 'deploy_app_service_plan'

‎infra/main.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1314,7 +1314,7 @@
13141314
"resources": [
13151315
{
13161316
"copy": {
1317-
"name": "database::list",
1317+
"name": "list",
13181318
"count": "[length(variables('containers'))]"
13191319
},
13201320
"type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",

‎infra/scripts/add_user_scripts/create-sql-user-and-role.ps1‎

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
.DESCRIPTION
88
During an application deployment, the managed identity (and potentially the developer identity)
99
must be added to the SQL database as a user and assigned to one or more roles. This script
10-
accomplishes this task using the owner-managed identity for authentication.
10+
accomplishes this task using Azure AD authentication.
1111
1212
.PARAMETER SqlServerName
1313
The name of the Azure SQL Server resource.
@@ -21,43 +21,36 @@
2121
.PARAMETER DisplayName
2222
The Object (Principal) display name of the identity to be added.
2323
24-
.PARAMETER ManagedIdentityClientId
25-
The Client ID of the managed identity that will authenticate to the SQL database.
24+
.PARAMETER UseManagedIdentity
25+
Switch to indicate whether to use a Managed Identity for authentication (useful for automation).
26+
If not provided, it will use your currently logged-in Azure AD account.
2627
2728
.PARAMETER DatabaseRole
2829
The database role that should be assigned to the user (e.g., db_datareader, db_datawriter, db_owner).
2930
#>
3031

31-
Param(
32+
param (
3233
[string] $SqlServerName,
3334
[string] $SqlDatabaseName,
3435
[string] $ClientId,
3536
[string] $DisplayName,
36-
[string] $ManagedIdentityClientId,
37+
[switch] $UseManagedIdentity,
3738
[string] $DatabaseRole
3839
)
3940

4041
function Resolve-Module($moduleName) {
41-
# If module is imported; say that and do nothing
42-
if (Get-Module | Where-Object { $_.Name -eq $moduleName }) {
43-
Write-Debug "Module $moduleName is already imported"
44-
} elseif (Get-Module -ListAvailable | Where-Object { $_.Name -eq $moduleName }) {
45-
Import-Module $moduleName
46-
} elseif (Find-Module -Name $moduleName | Where-Object { $_.Name -eq $moduleName }) {
47-
Install-Module $moduleName -Force -Scope CurrentUser
48-
Import-Module $moduleName
49-
} else {
50-
Write-Error "Module $moduleName not found"
51-
[Environment]::exit(1)
42+
if (-not (Get-Module -ListAvailable -Name $moduleName)) {
43+
Install-Module -Name $moduleName -Scope CurrentUser -Force -AllowClobber
5244
}
45+
Import-Module -Name $moduleName -Force
5346
}
5447

55-
###
56-
### MAIN SCRIPT
57-
###
48+
### Load Required Modules
49+
Resolve-Module -moduleName Az.Accounts
5850
Resolve-Module -moduleName Az.Resources
5951
Resolve-Module -moduleName SqlServer
6052

53+
### Generate SQL Script
6154
$sql = @"
6255
DECLARE @username nvarchar(max) = N'$($DisplayName)';
6356
DECLARE @clientId uniqueidentifier = '$($ClientId)';
@@ -70,8 +63,21 @@ END
7063
EXEC sp_addrolemember '$($DatabaseRole)', @username;
7164
"@
7265

73-
Write-Output "`nSQL:`n$($sql)`n`n"
66+
Write-Output "`nSQL to be executed:`n$($sql)`n"
67+
68+
### Authenticate and Get Access Token
69+
if ($UseManagedIdentity) {
70+
Write-Host "[INFO] Logging in using Managed Identity..."
71+
Connect-AzAccount -Identity
72+
} else {
73+
Write-Host "[INFO] Logging in using current user identity..."
74+
Connect-AzAccount
75+
}
7476

75-
Connect-AzAccount -Identity -AccountId $ManagedIdentityClientId
7677
$token = (Get-AzAccessToken -ResourceUrl https://database.windows.net/).Token
77-
Invoke-SqlCmd -ServerInstance "$SqlServerName" -Database $SqlDatabaseName -AccessToken $token -Query $sql -ErrorAction 'Stop'
78+
79+
### Execute the SQL Command
80+
Write-Host "[INFO] Executing SQL against $SqlDatabaseName..."
81+
Invoke-Sqlcmd -ServerInstance "$SqlServerName.database.windows.net" -Database $SqlDatabaseName -AccessToken $token -Query $sql -ErrorAction Stop
82+
83+
Write-Host "[SUCCESS] User and role assignment completed."

‎infra/scripts/copy_kb_files.sh‎

Lines changed: 56 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,71 @@
33
# Variables
44
storageAccount="$1"
55
fileSystem="$2"
6-
baseUrl="$3"
6+
# baseUrl="$3"
77
managedIdentityClientId="$4"
8+
keyVaultName="$5" # ✅ NEW ARG REQUIRED
89

910
zipFileName1="call_transcripts.zip"
1011
extractedFolder1="call_transcripts"
11-
zipUrl1=${baseUrl}"infra/data/call_transcripts.zip"
12+
zipUrl1="infra/data/call_transcripts.zip"
1213

1314
zipFileName2="audio_data.zip"
1415
extractedFolder2="audiodata"
15-
zipUrl2=${baseUrl}"infra/data/audio_data.zip"
16+
zipUrl2="infra/data/audio_data.zip"
1617

17-
# Create folders if they do not exist
18-
mkdir -p "/mnt/azscripts/azscriptinput/$extractedFolder1"
19-
mkdir -p "/mnt/azscripts/azscriptinput/$extractedFolder2"
18+
unzip infra/data/"$zipFileName1" -d infra/data/"$extractedFolder1"
19+
unzip infra/data/"$zipFileName2" -d infra/data/"$extractedFolder2"
2020

21-
# Download the zip file
22-
curl --output /mnt/azscripts/azscriptinput/"$zipFileName1" "$zipUrl1"
23-
curl --output /mnt/azscripts/azscriptinput/"$zipFileName2" "$zipUrl2"
21+
echo "Script Started"
2422

25-
# Extract the zip file
26-
unzip /mnt/azscripts/azscriptinput/"$zipFileName1" -d /mnt/azscripts/azscriptinput/"$extractedFolder1"
27-
unzip /mnt/azscripts/azscriptinput/"$zipFileName2" -d /mnt/azscripts/azscriptinput/"$extractedFolder2"
23+
# Authenticate with Azure
24+
if az account show &> /dev/null; then
25+
echo "Already authenticated with Azure."
26+
else
27+
if [ -n "$managedIdentityClientId" ]; then
28+
echo "Authenticating with Managed Identity..."
29+
az login --identity --client-id ${managedIdentityClientId}
30+
else
31+
echo "Authenticating with Azure CLI..."
32+
az login
33+
fi
34+
echo "Not authenticated with Azure. Attempting to authenticate..."
35+
fi
2836

29-
echo "Script Started"
37+
echo "Getting signed in user id"
38+
signed_user_id=$(az ad signed-in-user show --query id -o tsv)
39+
40+
echo "Getting storage account resource id"
41+
storage_account_resource_id=$(az storage account show --name $storageAccount --query id --output tsv)
42+
43+
# ✅ Assign Storage Blob Data Contributor role (if not already assigned)
44+
echo "Checking if user has the Storage Blob Data Contributor role"
45+
storage_role_assignment=$(az role assignment list --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --query "[].roleDefinitionId" -o tsv)
46+
47+
if [ -z "$storage_role_assignment" ]; then
48+
echo "Assigning Storage Blob Data Contributor role..."
49+
az role assignment create --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --output none
50+
echo "Role assignment for Blob Storage completed."
51+
else
52+
echo "User already has Storage Blob Data Contributor role."
53+
fi
54+
55+
# ✅ Assign Key Vault Secrets User role (NEW BLOCK)
56+
echo "Getting Key Vault resource ID"
57+
key_vault_resource_id=$(az keyvault show --name $keyVaultName --query id --output tsv)
58+
59+
echo "Checking if user has Key Vault Secrets User role"
60+
kv_role_assignment=$(az role assignment list --assignee $signed_user_id --role "Key Vault Secrets User" --scope $key_vault_resource_id --query "[].roleDefinitionId" -o tsv)
61+
62+
if [ -z "$kv_role_assignment" ]; then
63+
echo "Assigning Key Vault Secrets User role..."
64+
az role assignment create --assignee $signed_user_id --role "Key Vault Secrets User" --scope $key_vault_resource_id --output none
65+
echo "Role assignment for Key Vault completed."
66+
else
67+
echo "User already has Key Vault Secrets User role."
68+
fi
3069

31-
# Authenticate with Azure using managed identity
32-
az login --identity --client-id ${managedIdentityClientId}
33-
# Using az storage blob upload-batch to upload files with managed identity authentication, as the az storage fs directory upload command is not working with managed identity authentication.
34-
az storage blob upload-batch --account-name "$storageAccount" --destination data/"$extractedFolder1" --source /mnt/azscripts/azscriptinput/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite
35-
az storage blob upload-batch --account-name "$storageAccount" --destination data/"$extractedFolder2" --source /mnt/azscripts/azscriptinput/"$extractedFolder2" --auth-mode login --pattern '*' --overwrite
70+
# Upload files to Azure Storage
71+
echo "Uploading files to Azure Storage"
72+
az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder1" --source infra/data/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite --output none
73+
az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder2" --source infra/data/"$extractedFolder2" --auth-mode login --pattern '*' --overwrite --output none

‎infra/scripts/index_scripts/01_create_search_index.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
from azure.keyvault.secrets import SecretClient
22
from azure.identity import DefaultAzureCredential
3+
import sys
34

4-
key_vault_name = 'kv_to-be-replaced'
5-
managed_identity_client_id = 'mici_to-be-replaced'
5+
key_vault_name=sys.argv[1]
6+
managed_identity_client_id = sys.argv[2]
67
index_name = "call_transcripts_index"
78

89
def get_secrets_from_kv(kv_name, secret_name):

‎infra/scripts/index_scripts/02_create_cu_template_audio.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
from pathlib import Path
88
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
99

10-
key_vault_name = 'kv_to-be-replaced'
11-
managed_identity_client_id = 'mici_to-be-replaced'
10+
key_vault_name=sys.argv[1]
11+
managed_identity_client_id = sys.argv[2]
1212

1313
def get_secrets_from_kv(kv_name, secret_name):
1414

‎infra/scripts/index_scripts/02_create_cu_template_text.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
from pathlib import Path
88
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
99

10-
key_vault_name = 'kv_to-be-replaced'
11-
managed_identity_client_id = 'mici_to-be-replaced'
10+
key_vault_name=sys.argv[1]
11+
managed_identity_client_id = sys.argv[2]
1212

1313
def get_secrets_from_kv(kv_name, secret_name):
1414

0 commit comments

Comments
 (0)