Use Terraform to create an Azure AI Foundry hub

In this article, you use Terraform to create an Azure AI Foundry hub, a project, and AI services connection. A hub is a central place for data scientists and developers to collaborate on machine learning projects. It provides a shared, collaborative space to build, train, and deploy machine learning models. The hub is integrated with Azure Machine Learning and other Azure services, making it a comprehensive solution for machine learning tasks. The hub also allows you to manage and monitor your AI deployments, ensuring they're performing as expected.

Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.

• Create a resource group
• Set up a storage account
• Establish a key vault
• Configure AI services
• Build an Azure AI Foundry hub
• Develop an Azure AI Foundry project
• Establish an AI services connection

Prerequisites

• Create an Azure account with an active subscription. You can create an account for free.

• Install and configure Terraform

Implement the Terraform code

Note

The sample code for this article is located in the Azure Terraform GitHub repo. You can view the log file containing the test results from current and previous versions of Terraform. You may need to update the resource provider versions used in the template to use the latest available versions.

See more articles and sample code showing how to use Terraform to manage Azure resources

1. Create a directory in which to test and run the sample Terraform code and make it the current directory.

2. Create a file named providers.tf and insert the following code.

   terraform {
     required_version = ">= 1.0"
   
     required_providers {
       azurerm = {
         source  = "hashicorp/azurerm"
         version = "~>4.0"
       }
       random = {
         source  = "hashicorp/random"
         version = "~>3.0"
       }
     }
   }
   
   provider "azurerm" {
     features {
       key_vault {
         recover_soft_deleted_key_vaults    = false
         purge_soft_delete_on_destroy       = false
         purge_soft_deleted_keys_on_destroy = false
       }
       resource_group {
         prevent_deletion_if_contains_resources = false
       }
     }
   }
   

3. Create a file named main.tf and insert the following code.

   # Random pet to be used in resource group name
   resource "random_pet" "rg_name" {
     prefix = var.resource_group_name_prefix
   }
   
   # Create a resource group
   resource "azurerm_resource_group" "example" {
     location = var.resource_group_location
     name     = random_pet.rg_name.id
   }
   
   # Retrieve information about the current Azure client configuration
   data "azurerm_client_config" "current" {}
   
   # Generate random value for unique resource naming
   resource "random_string" "example" {
     length  = 8
     lower   = true
     numeric = false
     special = false
     upper   = false
   }
   
   # Create an Azure Key Vault resource
   resource "azurerm_key_vault" "example" {
     name                = random_string.example.result                 # Name of the Key Vault
     location            = azurerm_resource_group.example.location      # Location from the resource group
     resource_group_name = azurerm_resource_group.example.name          # Resource group name
     tenant_id           = data.azurerm_client_config.current.tenant_id # Azure tenant ID
   
     sku_name                 = "standard" # SKU tier for the Key Vault
     purge_protection_enabled = true       # Enables purge protection to prevent accidental deletion
   }
   
   # Set an access policy for the Key Vault to allow certain operations
   resource "azurerm_key_vault_access_policy" "test" {
     key_vault_id = azurerm_key_vault.example.id                 # Key Vault reference
     tenant_id    = data.azurerm_client_config.current.tenant_id # Tenant ID
     object_id    = data.azurerm_client_config.current.object_id # Object ID of the principal
   
     key_permissions = [ # List of allowed key permissions
       "Create",
       "Get",
       "Delete",
       "Purge",
       "GetRotationPolicy",
     ]
   }
   
   # Create an Azure Storage Account
   resource "azurerm_storage_account" "example" {
     name                     = random_string.example.result            # Storage account name
     location                 = azurerm_resource_group.example.location # Location from the resource group
     resource_group_name      = azurerm_resource_group.example.name     # Resource group name
     account_tier             = "Standard"                              # Performance tier
     account_replication_type = "LRS"                                   # Locally-redundant storage replication
   }
   
   # Deploy Azure AI Services resource
   resource "azurerm_ai_services" "example" {
     name                = "exampleaiservices"                     # AI Services resource name
     location            = azurerm_resource_group.example.location # Location from the resource group
     resource_group_name = azurerm_resource_group.example.name     # Resource group name
     sku_name            = "S0"                                    # Pricing SKU tier
   }
   
   # Create Azure AI Foundry service
   resource "azurerm_ai_foundry" "example" {
     name                = "exampleaihub"                       # AI Foundry service name
     location            = azurerm_ai_services.example.location # Location from the AI Services resource
     resource_group_name = azurerm_resource_group.example.name  # Resource group name
     storage_account_id  = azurerm_storage_account.example.id   # Associated storage account
     key_vault_id        = azurerm_key_vault.example.id         # Associated Key Vault
   
     identity {
       type = "SystemAssigned" # Enable system-assigned managed identity
     }
   }
   
   # Create an AI Foundry Project within the AI Foundry service
   resource "azurerm_ai_foundry_project" "example" {
     name               = "example"                           # Project name
     location           = azurerm_ai_foundry.example.location # Location from the AI Foundry service
     ai_services_hub_id = azurerm_ai_foundry.example.id       # Associated AI Foundry service
   
     identity {
       type = "SystemAssigned" # Enable system-assigned managed identity
     }
   }
   

4. Create a file named variables.tf and insert the following code.

   variable "resource_group_location" {
     type        = string
     default     = "eastus"
     description = "Location of the resource group."
   }
   
   variable "resource_group_name_prefix" {
     type        = string
     default     = "rg"
     description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
   }
   

5. Create a file named outputs.tf and insert the following code.

   output "resource_group_name" {
     value = azurerm_resource_group.example.id
   }
   
   output "workspace_name" {
     value = azurerm_ai_foundry.example.name
   }
   

Initialize Terraform

Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

terraform init -upgrade

Key points:

• The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

Create a Terraform execution plan

Run terraform plan to create an execution plan.

terraform plan -out main.tfplan

Key points:

• The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
• The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

Apply a Terraform execution plan

Run terraform apply to apply the execution plan to your cloud infrastructure.

terraform apply main.tfplan

Key points:

• The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
• If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
• If you didn't use the -out parameter, call terraform apply without any parameters.

Verify the results

Azure CLI

1. Get the Azure resource group name.

   resource_group_name=$(terraform output -raw resource_group_name)
   

2. Get the workspace name.

   workspace_name=$(terraform output -raw workspace_name)
   

3. Run az ml workspace show to display information about the new workspace.

   az ml workspace show --resource-group $resource_group_name \
                        --name $workspace_name
   

Azure PowerShell

1. Get the Azure resource group name.

   $resource_group_name=$(terraform output -raw resource_group_name)
   

2. Get the workspace name.

   $workspace_name=$(terraform output -raw workspace_name)
   

3. Run Get-AzMLWorkspace to display information about the new workspace.

   Get-AzMLWorkspace -ResourceGroupName $resource_group_name `
                     -Name $workspace_name
   

Clean up resources

When you no longer need the resources created via Terraform, do the following steps:

1. Run terraform plan and specify the destroy flag.

   terraform plan -destroy -out main.destroy.tfplan
   

   Key points:

   • The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
   • The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

2. Run terraform apply to apply the execution plan.

   terraform apply main.destroy.tfplan
   

Troubleshoot Terraform on Azure

Troubleshoot common problems when using Terraform on Azure.

Next steps

See more articles about Azure AI Foundry hub