A Model Endpoint Reached by Identity, not a Key

azure-cognitive-services

An Azure AI Services account that can be reached with an identity rather than a key, and not from the whole internet. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

custom_subdomain_name looks optional and decides everything. Without it the account answers on the shared regional endpoint, and on that endpoint Entra ID token authentication does not work and a private endpoint cannot be attached. So omitting one field that reads like a cosmetic choice silently produces a key-only, internet-facing service, whatever else you configured. It is also ForceNew - adding it later recreates the account, taking the endpoint your clients are configured with. This module requires it.

The customer-managed key is attached as a separate resource, not an inline block. azurerm offers both, and the inline one has an ordering problem you cannot configure your way out of: the account must exist before its managed identity exists, the identity must exist before Key Vault can grant it access, and the key cannot be attached before that grant. The separate resource splits that into two steps with the grant in between - which is also the shape a configuration scanner can follow from account to key.

local_auth_enabled defaults to true. The two API keys are bearer tokens with no identity attached: every caller looks the same in the logs, there is no per-caller revocation, and rotating means rotating for everybody at once. With a custom subdomain in place, Entra ID gives you RBAC and an audit trail with a name in it.

public_network_access_enabled defaults to true. For a model endpoint that is a public service holding whatever your users type into it.

outbound_network_access_restricted defaults to false, which matters for the features that fetch things: "on your data" and similar retrieval settings let the service call URLs, and unrestricted means it may call any of them.

Restricting outbound access is the data-loss-prevention control. For an OpenAI account specifically, it is what stops a retrieval feature - or a prompt that talks one into a fetch - from posting your data to an address you never listed. A precondition refuses an unrestricted OpenAI account unless accept_no_dlp says so; other account kinds are left alone, because demanding an FQDN list from all of them would break more than it protects.

Smaller things: a precondition refuses a Deny network ACL with no rules and no private endpoint, which would leave the account reachable by nothing at all; and another refuses restricted outbound access with an empty FQDN list, which breaks every retrieval feature silently.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.