Support for disabling the Azure ML compute public IP

iamahern commented 2 years ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

In order to secure azure ML resources, teams will seek to use a private endpoint configuration. Currently, virtual machine compute resources created by the AzureRM provider have no means to disable the public IP. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/machine_learning_compute_instance#arguments-reference

The feature is currently in preview (through the GUI), so I am unsure if the setting is available via the Azure GO API.

New or Affected Resource(s)

Both resource and datasource for azurerm machine_learning_compute_instance

Potential Terraform Configuration

N/A

References

Not at this time.

tybyers commented 2 years ago

Need this capability for azurerm_machine_learning_compute_cluster as well, please.

chboudry commented 1 year ago

While waiting for the feature to be integrated into azurerm_machine_learning_compute_instance you can leverage azure/azapi provider to target the last ARM schema.

Example:

resource "azapi_resource" "nopip_compute_instance" {
  name = "${random_string.ci_prefix.result}instance"
  parent_id = azurerm_machine_learning_workspace.default.id
  type = "Microsoft.MachineLearningServices/workspaces/computes@2022-06-01-preview"

  location = "westeurope"
  body = jsonencode({
    properties = {
      computeType      = "ComputeInstance"
      disableLocalAuth = true
      properties = {
        enableNodePublicIp = false
        vmSize = "STANDARD_DS2_V2"
        subnet = {
          id = "${azurerm_subnet.snet-training.id}"
        }
      }
    }
  })
  depends_on = [
    azurerm_private_endpoint.mlw_ple
  ]
}

https://github.com/chboudry/aml-secure-terraform

tybyers commented 1 year ago

Thanks @chboudry for the response. This is in fact what we are doing -- I should have put that here as a workaround. Seems to be working just fine, but certainly not as pretty as an azurerm... block would be in our template :).

hashicorp / terraform-provider-azurerm