เชื่อมต่อ AI Agent บน Microsoft Foundry กับ MCP ภายในองค์กร แบบปลอดภัย 100% ไม่ต้องออก Internet!

1
2① VNet
3② snet-agent (delegated) ─────────► ③ Foundry account
4   snet-pe                              (networkInjections → snet-agent,
5   Private DNS × 3 + links              publicNetworkAccess: Disabled)
6                                         │
7④ Private Endpoint ◄────────────────────┘ (ต้องรู้ account.id)
8   (snet-pe → account)                   │
9                     └─────────────────► ⑤ Project   (รอ PE เสร็จก่อน)
10                                         ⑥ Capability Host (Agents)
11                                         ⑥ Model deployment (รอแค่ account)
Copy

1## Virtual network and subnets
2##
3resource "azurerm_virtual_network" "this" {
4  name                = "vnet-${var.name_prefix}-${local.suffix}"
5  location            = var.location
6  resource_group_name = azurerm_resource_group.this.name
7  address_space       = [var.vnet_address_space]
8  tags                = var.tags
9}
10
Copy

1## Agent subnet delegated to Microsoft.App/environments — this delegation is what
2## makes VNet injection for AI Foundry agents possible.
3##
4resource "azurerm_subnet" "agent" {
5  name               = "snet-agent"
6  resource_group_name  = azurerm_resource_group.this.name
7  virtual_network_name = azurerm_virtual_network.this.name
8  address_prefixes     = [var.agent_subnet_prefix]
9
10  delegation {
11    name = "Microsoft.App/environments"
12    service_delegation {
13      name    = "Microsoft.App/environments"
14      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
15    }
16  }
17}
18
19## Subnet for the AI Foundry private endpoint
20##
21resource "azurerm_subnet" "pe" {
22  name                 = "snet-pe"
23  resource_group_name  = azurerm_resource_group.this.name
24  virtual_network_name = azurerm_virtual_network.this.name
25  address_prefixes     = [var.pe_subnet_prefix]
26}
Copy

1########## Create AI Foundry resource
2##########
3
4## Create the AI Foundry resource with VNet injection
5##
6resource "azapi_resource" "ai_foundry" {
7  depends_on = [
8    azurerm_subnet.subnet_agent,
9    azapi_resource_action.purge_ai_foundry
10  ]
11
12  type                      = "Microsoft.CognitiveServices/accounts@2025-06-01"
13  name                      = "aifoundry${random_string.unique.result}"
14  parent_id                 = azurerm_resource_group.rg.id
15  location                  = var.location
16  schema_validation_enabled = false
17
18  body = {
19    kind = "AIServices",
20    sku = {
21      name = "S0"
22    }
23    identity = {
24      type = "SystemAssigned"
25    }
26
27    properties = {
28      # Support both Entra ID and API Key authentication
29      disableLocalAuth = false
30
31      # Specifies that this is an AI Foundry resource
32      allowProjectManagement = true
33
34      # Set custom subdomain name for DNS
35      customSubDomainName = "aifoundry${random_string.unique.result}"
36
37      # Network-related controls
38      # Disable public access but allow Trusted Azure Services exception
39      publicNetworkAccess = "Disabled"
40      networkAcls = {
41        defaultAction = "Allow"
42      }
43
44      # Enable VNet injection for Agents
45      networkInjections = [
46        {
47          scenario                   = "agent"
48          subnetArmId                = azurerm_subnet.subnet_agent.id
49          useMicrosoftManagedNetwork = false
50        }
51      ]
52    }
53  }
54}
55
56
57
Copy

1## Private DNS zones required to resolve the AI Foundry account privately
2##
3resource "azurerm_private_dns_zone" "cognitiveservices" {
4  name                = "privatelink.cognitiveservices.azure.com"
5  resource_group_name = azurerm_resource_group.this.name
6  tags                = var.tags
7}
8
9resource "azurerm_private_dns_zone" "ai_services" {
10  name                = "privatelink.services.ai.azure.com"
11  resource_group_name = azurerm_resource_group.this.name
12  tags                = var.tags
13}
14
15resource "azurerm_private_dns_zone" "openai" {
16  name                = "privatelink.openai.azure.com"
17  resource_group_name = azurerm_resource_group.this.name
18  tags                = var.tags
19}
20
21resource "azurerm_private_dns_zone_virtual_network_link" "cognitiveservices" {
22  name                  = "link-cogsvc-${local.suffix}"
23  resource_group_name   = azurerm_resource_group.this.name
24  private_dns_zone_name = azurerm_private_dns_zone.cognitiveservices.name
25  virtual_network_id    = azurerm_virtual_network.this.id
26  registration_enabled  = false
27}
28
29resource "azurerm_private_dns_zone_virtual_network_link" "ai_services" {
30  name                  = "link-aiservices-${local.suffix}"
31  resource_group_name   = azurerm_resource_group.this.name
32  private_dns_zone_name = azurerm_private_dns_zone.ai_services.name
33  virtual_network_id    = azurerm_virtual_network.this.id
34  registration_enabled  = false
35}
36
37resource "azurerm_private_dns_zone_virtual_network_link" "openai" {
38  name                  = "link-openai-${local.suffix}"
39  resource_group_name   = azurerm_resource_group.this.name
40  private_dns_zone_name = azurerm_private_dns_zone.openai.name
41  virtual_network_id    = azurerm_virtual_network.this.id
42  registration_enabled  = false
43}
44
Copy

1## Private endpoint for the AI Foundry account
2##
3resource "azurerm_private_endpoint" "ai_foundry" {
4  depends_on = [
5    azurerm_private_dns_zone_virtual_network_link.cognitiveservices,
6    azurerm_private_dns_zone_virtual_network_link.ai_services,
7    azurerm_private_dns_zone_virtual_network_link.openai,
8  ]
9
10  name                = "pe-${azapi_resource.ai_foundry.name}"
11  location            = var.location
12  resource_group_name = azurerm_resource_group.this.name
13  subnet_id           = azurerm_subnet.pe.id
14  tags                = var.tags
15
16  private_service_connection {
17    name                           = "psc-${azapi_resource.ai_foundry.name}"
18    private_connection_resource_id = azapi_resource.ai_foundry.id
19    subresource_names              = ["account"]
20    is_manual_connection           = false
21  }
22
23  private_dns_zone_group {
24    name = "dns-${azapi_resource.ai_foundry.name}"
25    private_dns_zone_ids = [
26      azurerm_private_dns_zone.cognitiveservices.id,
27      azurerm_private_dns_zone.ai_services.id,
28      azurerm_private_dns_zone.openai.id,
29    ]
30  }
31}
32
Copy

1########## Create the AI Foundry project and capability host
2##########
3
4## Create AI Foundry project
5##
6resource "azapi_resource" "ai_foundry_project" {
7  depends_on = [
8    azapi_resource.ai_foundry,
9    azurerm_private_endpoint.pe_aifoundry
10  ]
11
12  type                      = "Microsoft.CognitiveServices/accounts/projects@2025-06-01"
13  name                      = "project${random_string.unique.result}"
14  parent_id                 = azapi_resource.ai_foundry.id
15  location                  = var.location
16  schema_validation_enabled = false
17
18  body = {
19    sku = {
20      name = "S0"
21    }
22    identity = {
23      type = "SystemAssigned"
24    }
25
26    properties = {
27      displayName = "project"
28      description = "A project for the AI Foundry account with network secured basic Agent"
29    }
30  }
31
32  response_export_values = [
33    "identity.principalId",
34    "properties.internalId"
35  ]
36}
37
38## Create the AI Foundry project capability host (basic agent - no BYO connections)
39##
40resource "azapi_resource" "ai_foundry_project_capability_host" {
41  depends_on = [
42    azapi_resource.ai_foundry_project
43  ]
44  type                      = "Microsoft.CognitiveServices/accounts/projects/capabilityHosts@2025-04-01-preview"
45  name                      = "caphostproj"
46  parent_id                 = azapi_resource.ai_foundry_project.id
47  schema_validation_enabled = false
48
49  body = {
50    properties = {
51      capabilityHostKind = "Agents"
52    }
53  }
54}
55
56## Create a deployment for the model in the AI Foundry resource
57##
58resource "azurerm_cognitive_deployment" "aifoundry_deployment_gpt_4o" {
59  depends_on = [
60    azapi_resource.ai_foundry
61  ]
62
63  name                 = var.model_name
64  cognitive_account_id = azapi_resource.ai_foundry.id
65
66  sku {
67    name     = var.model_sku_name
68    capacity = var.model_capacity
69  }
70
71  model {
72    format  = "OpenAI"
73    name    = var.model_name
74    version = var.model_version
75  }
76}
Copy