Tutorial: How to create a secure workspace by using a template

• Either the Azure CLI or Azure PowerShell Bicep command-line tools installed according to Set up Bicep development and deployment environments.

• The GitHub repo containing the Bicep template Azure Machine Learning end-to-end secure setup, cloned locally and switched to by running the following commands:

  git clone https://github.com/Azure/azure-quickstart-templates
  cd azure-quickstart-templates/quickstarts/microsoft.machinelearningservices/machine-learning-end-to-end-secure
  

• Terraform installed, configured, and authenticated to your Azure subscription by using the steps in one of the following articles:

  • Azure Cloud Shell
  • Windows with Bash
  • Windows with Azure PowerShell

• The GitHub repo containing the Terraform template Azure Machine Learning workspace (moderately secure network set up), cloned locally and switched to by running the following commands:

  git clone https://github.com/Azure/terraform
  cd terraform/quickstart/201-machine-learning-moderately-secure
  

The Bicep template is made up of the main.bicep and other *.bicep files in the modules subdirectory. The following table describes what each file is responsible for:

The Terraform template consists of multiple files. The following table describes what each file is responsible for:

To deploy the Bicep template, make sure you're in the machine-learning-end-to-end-secure directory where the main.bicep file is located, and run the following commands:

1. To create a new Azure resource group, run the following example command, replacing <myrgname> with a resource group name and <location> with the Azure region you want to use.

   • Azure CLI:

     az group create --name <myrgname> --location <location>
     

   • Azure PowerShell:

     New-AzResourceGroup -Name <myrgname> -Location <location>
     

2. To deploy the template, use the following command, replacing <myrgname> with the name of the resource group you created, and <pref> with a unique prefix to use when creating required resources. Replace <mydsvmpassword> with a secure password for the DSVM jump box sign-in account, which is azureadmin in the following examples.

   Tip

   The prefix must be five or fewer characters, and can't be entirely numeric or contain the characters ~, !, @, #, $, %, ^, &, *, (, ), =, +, _, [, ], {, }, \, |, ;, :, ., ', ", ,, <, >, /, or ?.

   • Azure CLI:

     az deployment group create \
         --resource-group <myrgname> \
         --template-file main.bicep \
         --parameters \
         prefix=<pref> \
         dsvmJumpboxUsername=azureadmin \
         dsvmJumpboxPassword=<mydsvmpassword>
     

   • Azure PowerShell:

     $dsvmPassword = ConvertTo-SecureString "<mydsvmpassword>" -AsPlainText -Force
     New-AzResourceGroupDeployment -ResourceGroupName <myrgname> `
         -TemplateFile ./main.bicep `
         -prefix "<pref>" `
         -dsvmJumpboxUsername "azureadmin" `
         -dsvmJumpboxPassword $dsvmPassword
     

     Warning

     You should avoid using plain text strings in scripts or from the command line. The plain text can show up in event logs and command history. For more information, see ConvertTo-SecureString.

To deploy the Terraform template, make sure you're in the 201-machine-learning-moderately-secure directory where the template files are located, and run the following commands.

1. To initialize the directory for working with Terraform, use the following command:

   terraform init
   

2. To create a configuration, use the following command. Use the -var parameters to set the values for the variables the template uses. For a full list of variables, see the variables.tf file.

   terraform plan \
       -var name=myworkspace \
       -var environment=dev \
       -var location=chinaeast2 \
       -var dsvm_name=jumpbox \
       -var dsvm_host_password=secure_password \
       -out azureml.tfplan
   

   After this command completes, the configuration displays in the terminal. To display it again, use the terraform show azureml.tfplan command.

3. To deploy the template and apply the saved configuration to your Azure subscription, use the following command:

   terraform apply azureml.tfplan
   

   The progress displays as the template processes.

The Bicep template generates the jump box name programmatically by using the prefix value provided to the template. To make sure the name doesn't exceed 15 characters or contain any invalid characters, use a prefix that's five or fewer characters and doesn't use the characters ~, !, @, #, $, %, ^, &, *, (, ), =, +, _, [, ], {, }, \, |, ;, :, ., ', ", ,, <, >, /, or ?.

The Terraform template passes the jump box name by using the dsvm_name parameter. To avoid the error, use a name that's 15 characters or fewer and doesn't use the characters ~, !, @, #, $, %, ^, &, *, (, ), =, +, _, [, ], {, }, \, |, ;, :, ., ', ", ,, <, >, /, or ?.