Azure OpenAI Terraform Module

This Terraform module deploys Azure OpenAI Service (Cognitive Services) with model deployments, network security, RBAC, and private endpoint support.

Features

• ✅ Azure OpenAI Service deployment
• ✅ Multiple model deployments (GPT-4, GPT-3.5-Turbo, etc.)
• ✅ Network ACLs and VNet integration
• ✅ Private Endpoint support with Private DNS
• ✅ Managed Identity (System and User Assigned)
• ✅ RBAC role assignments
• ✅ Flexible scaling options
• ✅ Custom subdomain configuration
• ✅ Tags support

Usage

Basic Example

module "azure_openai" {
  source = "./terraform-azurerm-gpt"

  name                = "my-openai-service"
  location            = "eastus"
  resource_group_name = "my-rg"
  sku_name            = "S0"

  deployments = [
    {
      name           = "gpt-4"
      model_format   = "OpenAI"
      model_name     = "gpt-4"
      model_version  = "0613"
      scale_type     = "Standard"
      scale_capacity = 10
    },
    {
      name           = "gpt-35-turbo"
      model_format   = "OpenAI"
      model_name     = "gpt-35-turbo"
      model_version  = "0613"
      scale_type     = "Standard"
      scale_capacity = 20
    }
  ]

  tags = {
    Environment = "Production"
    Project     = "AI-Platform"
  }
}

Advanced Example with Private Endpoint

module "azure_openai" {
  source = "./terraform-azurerm-gpt"

  name                = "my-private-openai"
  location            = "eastus"
  resource_group_name = "my-rg"
  sku_name            = "S0"

  # Network Configuration
  public_network_access_enabled      = false
  outbound_network_access_restricted = true

  network_acls = {
    default_action = "Deny"
    ip_rules       = ["203.0.113.0/24"]
    subnet_id      = "/subscriptions/.../subnets/openai-subnet"
  }

  # Private Endpoint
  private_endpoint_enabled   = true
  private_endpoint_subnet_id = "/subscriptions/.../subnets/pe-subnet"
  private_dns_zone_ids       = ["/subscriptions/.../privateDnsZones/privatelink.openai.azure.com"]

  # Managed Identity
  identity_type = "SystemAssigned"

  # Model Deployments
  deployments = [
    {
      name           = "gpt-4-turbo"
      model_format   = "OpenAI"
      model_name     = "gpt-4"
      model_version  = "turbo-2024-04-09"
      scale_type     = "Standard"
      scale_capacity = 30
    }
  ]

  # RBAC
  cognitive_services_openai_user_principals = [
    "user-principal-id-1",
    "user-principal-id-2"
  ]

  tags = {
    Environment = "Production"
    Security    = "High"
  }
}

Model Deployments

Common model configurations:

GPT-4 Models

{
  name           = "gpt-4"
  model_format   = "OpenAI"
  model_name     = "gpt-4"
  model_version  = "0613"
  scale_type     = "Standard"
  scale_capacity = 10
}

GPT-3.5 Turbo

{
  name           = "gpt-35-turbo"
  model_format   = "OpenAI"
  model_name     = "gpt-35-turbo"
  model_version  = "0613"
  scale_type     = "Standard"
  scale_capacity = 20
}

GPT-4 Vision

{
  name           = "gpt-4-vision"
  model_format   = "OpenAI"
  model_name     = "gpt-4"
  model_version  = "vision-preview"
  scale_type     = "Standard"
  scale_capacity = 10
}

DALL-E 3

{
  name           = "dall-e-3"
  model_format   = "OpenAI"
  model_name     = "dall-e-3"
  model_version  = "3.0"
  scale_type     = "Standard"
  scale_capacity = 1
}

Requirements

Name	Version
terraform	>= 1.5.0
azurerm	>= 3.80.0

Providers

Name	Version
azurerm	>= 3.80.0

Resources

Name	Type
azurerm_cognitive_account.openai	resource
azurerm_cognitive_deployment.deployment	resource
azurerm_role_assignment.openai_user	resource
azurerm_role_assignment.openai_contributor	resource
azurerm_private_endpoint.openai	resource

Inputs

Name	Description	Type	Default	Required
name	The name of the Cognitive Services account for OpenAI	string	n/a	yes
location	The Azure region where the OpenAI resource should be created	string	n/a	yes
resource_group_name	The name of the resource group	string	n/a	yes
sku_name	The SKU name of the Cognitive Services account	string	"S0"	no
custom_subdomain_name	The custom subdomain name	string	""	no
public_network_access_enabled	Whether public network access is allowed	bool	true	no
outbound_network_access_restricted	Whether outbound network access should be restricted	bool	false	no
identity_type	The type of Managed Identity	string	"SystemAssigned"	no
identity_ids	List of User Assigned Managed Identity IDs	list(string)	[]	no
network_acls	Network ACLs configuration	object	null	no
deployments	List of model deployments to create	list(object)	[]	no
cognitive_services_openai_user_principals	List of principal IDs for OpenAI User role	list(string)	[]	no
cognitive_services_openai_contributor_principals	List of principal IDs for OpenAI Contributor role	list(string)	[]	no
private_endpoint_enabled	Whether to create a private endpoint	bool	false	no
private_endpoint_subnet_id	The subnet ID for private endpoint	string	null	no
private_dns_zone_ids	List of private DNS zone IDs	list(string)	null	no
tags	A mapping of tags to assign to resources	map(string)	{}	no

Outputs

Name	Description
id	The ID of the Cognitive Services account
name	The name of the Cognitive Services account
endpoint	The endpoint URL
primary_access_key	The primary access key (sensitive)
secondary_access_key	The secondary access key (sensitive)
identity_principal_id	The Principal ID of the Managed Identity
identity_tenant_id	The Tenant ID of the Managed Identity
deployments	Map of deployed models
private_endpoint_id	The ID of the private endpoint
private_endpoint_ip_address	The private IP address

Available Azure Regions for OpenAI

Not all Azure regions support OpenAI. Check the current list:

• East US
• East US 2
• South Central US
• West Europe
• France Central
• UK South
• Sweden Central
• Switzerland North

License

MIT

Contributing

Contributions are welcome! Please open an issue or submit a pull request.