Merge branch 'psl-waf-macaev3' of https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator into psl-waf-macaev3

Author: Dhruvkumar-Microsoft

azure.yaml

@@ -5,7 +5,7 @@ metadata:
 requiredVersions:
   azd: ">=1.15.0 !=1.17.1"
 hooks:
-  postprovision:
+  postdeploy:
     windows:
       run: |
         Write-Host "To upload Team Configurations to Cosmos. Run the following command in PowerShell:"

azure_custom.yaml

@@ -41,7 +41,7 @@ services:
           continueOnError: false
 
 hooks:
-  postprovision:
+  postdeploy:
     windows:
       run: |
         Write-Host "To upload Team Configurations to Cosmos. Run the following command in PowerShell:"

infra/main.bicep

@@ -946,13 +946,15 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.17.0' = if (e
 }
 
 // ========== Private DNS Zones ========== //
+var keyVaultPrivateDNSZone = 'privatelink.${toLower(environment().name) == 'azureusgovernment' ? 'vaultcore.usgovcloudapi.net' : 'vaultcore.azure.net'}'
 var privateDnsZones = [
   'privatelink.cognitiveservices.azure.com'
   'privatelink.openai.azure.com'
   'privatelink.services.ai.azure.com'
   'privatelink.documents.azure.com'
   'privatelink.blob.core.windows.net'
   'privatelink.search.windows.net'
+  keyVaultPrivateDNSZone
 ]
 
 // DNS Zone Index Constants
@@ -963,6 +965,7 @@ var dnsZoneIndex = {
   cosmosDb: 3
   blob: 4
   search: 5
+  keyVault: 6
 }
 
 // List of DNS zone indices that correspond to AI-related services.
@@ -1550,7 +1553,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
           } 
           {
             name: 'AZURE_AI_SEARCH_API_KEY'
-            value: ''
+            secretRef: 'azure-ai-search-api-key'
           } 
           {
             name: 'BING_CONNECTION_NAME'
@@ -1569,6 +1572,14 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
             value: aiFoundryAiServicesModelDeployment.name
           }
         ]
+        
+      }
+    ]
+    secrets: [
+      {
+        name: 'azure-ai-search-api-key'
+        keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
+        identity: userAssignedIdentity.outputs.resourceId
       }
     ]
   }
@@ -1909,13 +1920,68 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
     searchServiceResourceId: searchService.outputs.resourceId
     searchServiceLocation: searchService.outputs.location
     searchServiceName: searchService.outputs.name
+    searchApiKey: searchService.outputs.primaryKey
   }
   dependsOn: [
     aiFoundryAiServices
   ]
 }
 
 
+// ========== KeyVault ========== //
+var keyVaultName = 'kv-${solutionSuffix}'
+module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
+  name: take('avm.res.key-vault.vault.${keyVaultName}', 64)
+  params: {
+    name: keyVaultName
+    location: location
+    tags: tags
+    sku: enableScalability ? 'premium' : 'standard'
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    networkAcls: {
+      defaultAction: 'Allow'
+    }
+    enableVaultForDeployment: true
+    enableVaultForDiskEncryption: true
+    enableVaultForTemplateDeployment: true
+    enableRbacAuthorization: true
+    enableSoftDelete: true
+    softDeleteRetentionInDays: 7
+    diagnosticSettings: enableMonitoring 
+      ? [{ workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId }] 
+      : []
+    // WAF aligned configuration for Private Networking
+    privateEndpoints: enablePrivateNetworking
+      ? [
+          {
+            name: 'pep-${keyVaultName}'
+            customNetworkInterfaceName: 'nic-${keyVaultName}'
+            privateDnsZoneGroup: {
+              privateDnsZoneGroupConfigs: [{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.keyVault]!.outputs.resourceId }]
+            }
+            service: 'vault'
+            subnetResourceId: virtualNetwork!.outputs.subnetResourceIds[0]
+          }
+        ]
+      : []
+    // WAF aligned configuration for Role-based Access Control
+    roleAssignments: [
+      {
+         principalId: userAssignedIdentity.outputs.principalId
+         principalType: 'ServicePrincipal'
+         roleDefinitionIdOrName: 'Key Vault Administrator'
+      }
+    ]
+    secrets: [
+      {
+        name: 'AzureAISearchAPIKey'
+        value: searchService.outputs.primaryKey
+      }
+    ]
+    enableTelemetry: enableTelemetry
+  }
+}
+
 // ============ //
 // Outputs      //
 // ============ //
@@ -1961,3 +2027,4 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
 output MCP_SERVER_NAME string = 'MACAE MCP Server'
 output MCP_SERVER_DESCRIPTION string = 'MACAE MCP Server Description'
 output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
+output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'

infra/main_custom.bicep

@@ -919,13 +919,15 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.17.0' = if (e
 }
 
 // ========== Private DNS Zones ========== //
+var keyVaultPrivateDNSZone = 'privatelink.${toLower(environment().name) == 'azureusgovernment' ? 'vaultcore.usgovcloudapi.net' : 'vaultcore.azure.net'}'
 var privateDnsZones = [
   'privatelink.cognitiveservices.azure.com'
   'privatelink.openai.azure.com'
   'privatelink.services.ai.azure.com'
   'privatelink.documents.azure.com'
   'privatelink.blob.core.windows.net'
   'privatelink.search.windows.net'
+  keyVaultPrivateDNSZone
 ]
 
 // DNS Zone Index Constants
@@ -936,6 +938,7 @@ var dnsZoneIndex = {
   cosmosDb: 3
   blob: 4
   search: 5
+  keyVault: 6
 }
 
 // List of DNS zone indices that correspond to AI-related services.
@@ -1516,7 +1519,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
           } 
           {
             name: 'AZURE_AI_SEARCH_API_KEY'
-            value: ''
+            value: 'azure-ai-search-api-key'
           } 
           {
             name: 'BING_CONNECTION_NAME'
@@ -1533,6 +1536,13 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
         ]
       }
     ]
+    secrets: [
+      {
+        name: 'azure-ai-search-api-key'
+        keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
+        identity: userAssignedIdentity.outputs.resourceId
+      }
+    ]
   }
 }
 
@@ -1880,13 +1890,68 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
     searchServiceResourceId: searchService.outputs.resourceId
     searchServiceLocation: searchService.outputs.location
     searchServiceName: searchService.outputs.name
+    searchApiKey: searchService.outputs.primaryKey
   }
   dependsOn: [
     aiFoundryAiServices
   ]
 }
 
 
+// ========== KeyVault ========== //
+var keyVaultName = 'kv-${solutionSuffix}'
+module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
+  name: take('avm.res.key-vault.vault.${keyVaultName}', 64)
+  params: {
+    name: keyVaultName
+    location: location
+    tags: tags
+    sku: enableScalability ? 'premium' : 'standard'
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    networkAcls: {
+      defaultAction: 'Allow'
+    }
+    enableVaultForDeployment: true
+    enableVaultForDiskEncryption: true
+    enableVaultForTemplateDeployment: true
+    enableRbacAuthorization: true
+    enableSoftDelete: true
+    softDeleteRetentionInDays: 7
+    diagnosticSettings: enableMonitoring 
+      ? [{ workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId }] 
+      : []
+    // WAF aligned configuration for Private Networking
+    privateEndpoints: enablePrivateNetworking
+      ? [
+          {
+            name: 'pep-${keyVaultName}'
+            customNetworkInterfaceName: 'nic-${keyVaultName}'
+            privateDnsZoneGroup: {
+              privateDnsZoneGroupConfigs: [{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.keyVault]!.outputs.resourceId }]
+            }
+            service: 'vault'
+            subnetResourceId: virtualNetwork!.outputs.subnetResourceIds[0]
+          }
+        ]
+      : []
+    // WAF aligned configuration for Role-based Access Control
+    roleAssignments: [
+      {
+         principalId: userAssignedIdentity.outputs.principalId
+         principalType: 'ServicePrincipal'
+         roleDefinitionIdOrName: 'Key Vault Administrator'
+      }
+    ]
+    secrets: [
+      {
+        name: 'AzureAISearchAPIKey'
+        value: searchService.outputs.primaryKey
+      }
+    ]
+    enableTelemetry: enableTelemetry
+  }
+}
+
 // ============ //
 // Outputs      //
 // ============ //
@@ -1948,3 +2013,4 @@ output REASONING_MODEL_NAME string = 'o3'
 output MCP_SERVER_NAME string = 'MACAE MCP Server'
 output MCP_SERVER_DESCRIPTION string = 'MACAE MCP Server Description'
 output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
+output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'

infra/modules/aifp-connections.bicep

@@ -4,13 +4,18 @@ param searchServiceResourceId string
 param searchServiceLocation string
 param aiFoundryName string
 param aiFoundryProjectName string
+@secure()
+param searchApiKey string
 
 resource aiSearchFoundryConnection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-04-01-preview' = {
   name: '${aiFoundryName}/${aiFoundryProjectName}/${aifSearchConnectionName}'
   properties: {
     category: 'CognitiveSearch'
     target: 'https://${searchServiceName}.search.windows.net'
-    authType: 'AAD'
+    authType: 'ApiKey'
+    credentials: {
+      key: searchApiKey
+    }
     isSharedToAll: true
     metadata: {
       ApiType: 'Azure'