Deploy AI Landing Zone to Azure

When to Use

• User asks to deploy landing zone infrastructure
• User asks to provision networking, VNets, private endpoints
• User asks to set up Bicep deployment
• User mentions azd, az deployment, infrastructure

Step 1: Validate Bicep Templates

# Lint for best practices
az bicep lint --file infra/main.bicep

# Build to check compilation
az bicep build --file infra/main.bicep

# What-if (dry run — shows what will be created/modified)
az deployment sub what-if \
  --location eastus2 \
  --template-file infra/main.bicep \
  --parameters infra/parameters.json

Step 2: Deploy Hub Network

# Create management group or subscription scope
az deployment sub create \
  --location eastus2 \
  --template-file infra/main.bicep \
  --parameters infra/parameters.json \
  --name deploy-landing-zone-$(date +%Y%m%d)

Key Resources Deployed

Step 3: Configure Private Endpoints

For each AI service, create a private endpoint in the PrivateEndpointSubnet:

# Verify private endpoints are created
az network private-endpoint list \
  --resource-group rg-ai-landing-zone \
  --query "[].{Name:name, Status:privateLinkServiceConnections[0].privateLinkServiceConnectionState.status}" \
  -o table

Expected: All endpoints show Approved status.

Step 4: Configure RBAC

# List current role assignments
az role assignment list --resource-group rg-ai-landing-zone -o table

# Verify least-privilege: no Owner/Contributor on production resources
# Expected roles:
#   Cognitive Services OpenAI User (for apps accessing OpenAI)
#   Search Index Data Reader (for apps querying search)
#   Storage Blob Data Reader (for apps reading documents)
#   Key Vault Secrets User (for apps reading secrets)

Step 5: Verify Networking

# Check VNet peering status
az network vnet peering list --resource-group rg-hub --vnet-name vnet-hub -o table

# Check NSG rules
az network nsg rule list --resource-group rg-ai-landing-zone --nsg-name nsg-private-endpoints -o table

# Check DNS resolution for private endpoints
nslookup oai-frootai.openai.azure.com  # Should resolve to 10.1.1.x (private IP)

Step 6: Enable Monitoring

# Verify diagnostic settings on all resources
az monitor diagnostic-settings list --resource /subscriptions/.../openai -o table

# Check Log Analytics workspace is receiving data
az monitor log-analytics query \
  --workspace ws-ai-landing-zone \
  --analytics-query "AzureDiagnostics | take 10" \
  --timespan PT1H

Step 7: Smoke Tests

# Test private endpoint connectivity from within VNet
az containerapp exec --name app-test --resource-group rg-ai-landing-zone \
  --command "curl -s https://oai-frootai.openai.azure.com/openai/models?api-version=2024-04-01-preview"

# Test Key Vault access
az keyvault secret list --vault-name kv-ai-landing-zone -o table

Troubleshooting