### Default Terraform Configuration for Cognitive Services Account

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/rai_policy/README.md

This HCL code block demonstrates a typical Terraform setup for deploying an Azure Cognitive Services Account. It includes provider requirements, resource group definition, and module instantiation for the Cognitive Services Account, specifying OpenAI deployment details and RAI policies. It also shows the use of the Azure/naming module for resource naming conventions.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}


# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = var.location
  name     = "avm-res-cognitiveservices-account-rai-${module.naming.resource_group.name_unique}"
}

resource "random_pet" "pet" {}

module "test" {
  source = "../../"

  kind                = "OpenAI"
  location            = azurerm_resource_group.this.location
  name                = "OpenAI-${random_pet.pet.id}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S0"
  cognitive_deployments = {
    "gpt-4o-mini" = {
      name            = "gpt-4o-mini"
      rai_policy_name = "policy0"
      model = {
        format  = "OpenAI"
        name    = "gpt-4o-mini"
        version = "2024-07-18"
      }
      scale = {
        type = "Standard"
      }
    }
  }
  enable_telemetry = false
  rai_policies = {
    policy1 = {
      name             = "policy0"
      base_policy_name = "Microsoft.Default"
      mode             = "Asynchronous_filter"
      content_filters = [{
        name               = "Hate"
        blocking           = true
        enabled            = true
        severity_threshold = "High"
        source             = "Prompt"
      }]
    }
  }
}
```

--------------------------------

### Terraform Modules Used

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet lists the Terraform modules called by the project. It includes the 'naming' module from Azure/naming and a local module referencing the current project's path.

```terraform
module "naming" {
  source = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

module "test" {
  source = "../../"
}
```

--------------------------------

### Terraform Configuration and Provider Setup

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/default/README.md

Defines the required Terraform version and providers, including the Azure Resource Manager (azurerm) provider with specific feature configurations.

```terraform
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This section lists the required Terraform providers and their version constraints for this module. It ensures compatibility with specific versions of Terraform core and essential Azure-related providers.

```terraform
terraform = ">= 1.9, < 2.0"
azurerm = "~> 4.0"
random = ">= 3.5.0, < 4.0.0"
time = "0.12.1"
```

--------------------------------

### Terraform Configuration for Azure AI Service

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This HCL code defines the Terraform configuration for deploying an Azure AI service. It includes provider requirements, resource group creation, user-assigned identity, Key Vault setup with access policies, Key Vault certificates with renewal policies, and a Hardware Security Module (HSM). It leverages the `azurerm` and `random` providers.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
    time = {
      source  = "hashicorp/time"
      version = "0.12.1"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
    key_vault {
      purge_soft_delete_on_destroy                                = true
      recover_soft_deleted_key_vaults                             = true
      purge_soft_deleted_hardware_security_modules_on_destroy     = true
      purge_soft_deleted_hardware_security_module_keys_on_destroy = true
    }
  }
}

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "westus"
  name     = "avm-res-aiservice-${module.naming.resource_group.name_unique}"
}

resource "random_string" "suffix" {
  length  = 15
  numeric = false
  special = false
  upper   = false
}

data "azurerm_client_config" "this" {}

resource "azurerm_user_assigned_identity" "this" {
  location            = azurerm_resource_group.this.location
  name                = "uai-aiservice"
  resource_group_name = azurerm_resource_group.this.name
}

resource "azurerm_key_vault" "this" {
  location                   = azurerm_resource_group.this.location
  name                       = "avmcog${replace(random_string.suffix.result, "-", "")}"
  resource_group_name        = azurerm_resource_group.this.name
  sku_name                   = "premium"
  tenant_id                  = data.azurerm_client_config.this.tenant_id
  purge_protection_enabled   = true
  soft_delete_retention_days = 7

  access_policy {
    certificate_permissions = [
      "Create",
      "Delete",
      "DeleteIssuers",
      "Get",
      "Purge",
      "Update"
    ]
    key_permissions = [
      "Create",
      "Delete",
      "Get",
      "Purge",
      "Recover",
      "Update",
      "GetRotationPolicy",
      "SetRotationPolicy"
    ]
    object_id = data.azurerm_client_config.this.object_id
    secret_permissions = [
      "Delete",
      "Get",
      "Set",
    ]
    tenant_id = data.azurerm_client_config.this.tenant_id
  }
  access_policy {
    key_permissions = [
      "Get",
      "Create",
      "List",
      "Restore",
      "Recover",
      "UnwrapKey",
      "WrapKey",
      "Purge",
      "Encrypt",
      "Decrypt",
      "Sign",
      "Verify",
    ]
    object_id = azurerm_user_assigned_identity.this.principal_id
    secret_permissions = [
      "Delete",
      "Get",
      "Set",
    ]
    tenant_id = data.azurerm_client_config.this.tenant_id
  }
}

resource "azurerm_key_vault_certificate" "cert" {
  count = 3

  key_vault_id = azurerm_key_vault.this.id
  name         = "hsmcert${count.index}"

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }
    key_properties {
      exportable = true
      key_type   = "RSA"
      reuse_key  = true
      key_size   = 2048
    }
    secret_properties {
      content_type = "application/x-pkcs12"
    }
    lifetime_action {
      action {
        action_type = "AutoRenew"
      }
      trigger {
        days_before_expiry = 30
      }
    }
    x509_certificate_properties {
      key_usage = [
        "cRLSign",
        "dataEncipherment",
        "digitalSignature",
        "keyAgreement",
        "keyCertSign",
        "keyEncipherment",
      ]
      subject            = "CN=hello-world"
      validity_in_months = 12
      extended_key_usage = []
    }
  }
}

resource "azurerm_key_vault_managed_hardware_security_module" "this" {
  admin_object_ids                          = [data.azurerm_client_config.this.object_id]
  location                                  = azurerm_resource_group.this.location
  name                                      = "avmcoghsm${replace(random_string.suffix.result, "-", "")}"
  resource_group_name                       = azurerm_resource_group.this.name
  sku_name                                  = "Standard_B1"
  tenant_id                                 = data.azurerm_client_config.this.tenant_id
  purge_protection_enabled                  = true
  security_domain_key_vault_certificate_ids = [for cert in azurerm_key_vault_certificate.cert : cert.id]
  security_domain_quorum                    = 2
  soft_delete_retention_days                = 7
}

resource "random_uuid" "role_assignments_names" {
  count = 3
}

```

--------------------------------

### Terraform Data Source for Client Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet shows the use of the 'azurerm_client_config' data source in Terraform. It retrieves information about the current Azure client configuration, which can be useful for dynamic resource creation or policy enforcement.

```terraform
data "azurerm_client_config" "this" {}
```

--------------------------------

### Azure Client Configuration and Key Vault Setup

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-customer_managed_key_encryption/README.md

Retrieves Azure client configuration and sets up an Azure Key Vault with premium SKU, purge protection, and soft delete enabled. It includes access policies for key management and secret retrieval.

```hcl
data "azurerm_client_config" "this" {}

resource "azurerm_key_vault" "this" {
  location                   = azurerm_resource_group.this.location
  name                       = "zjhecogkv${replace(random_string.suffix.result, "-", "")}"
  resource_group_name        = azurerm_resource_group.this.name
  sku_name                   = "premium"
  tenant_id                  = data.azurerm_client_config.this.tenant_id
  purge_protection_enabled   = true
  soft_delete_retention_days = 7

  access_policy {
    key_permissions = [
      "Create",
      "Delete",
      "Get",
      "Purge",
      "Recover",
      "Update",
      "GetRotationPolicy",
      "SetRotationPolicy"
    ]
    object_id = data.azurerm_client_config.this.object_id
    tenant_id = data.azurerm_client_config.this.tenant_id
  }
  access_policy {
    key_permissions = [
      "Get",
      "Create",
      "List",
      "Restore",
      "Recover",
      "UnwrapKey",
      "WrapKey",
      "Purge",
      "Encrypt",
      "Decrypt",
      "Sign",
      "Verify",
    ]
    object_id = azurerm_user_assigned_identity.this.principal_id
    secret_permissions = [
      "Get",
    ]
    tenant_id = data.azurerm_client_config.this.tenant_id
  }
}
```

--------------------------------

### Configure Azure Cognitive Services Account with HSM

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet defines the Terraform resources for creating an Azure Cognitive Services account. It includes setting up role assignments for HSM Crypto User and Officer roles, creating an HSM key, and configuring the account to use customer-managed keys with a user-assigned identity. Dependencies are managed using `time_sleep` to ensure proper ordering.

```terraform
resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "hsm_crypto_user" {
  managed_hsm_id     = azurerm_key_vault_managed_hardware_security_module.this.id
  name               = random_uuid.role_assignments_names[0].result
  principal_id       = data.azurerm_client_config.this.object_id
  role_definition_id = "/Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/21dbd100-6940-42c2-9190-5d6cb909625b"
  scope              = "/keys"
}

resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "hsm_crypto_officer" {
  managed_hsm_id     = azurerm_key_vault_managed_hardware_security_module.this.id
  name               = random_uuid.role_assignments_names[1].result
  principal_id       = data.azurerm_client_config.this.object_id
  role_definition_id = "/Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/515eb02d-2335-4d2d-92f2-b1cbdf9c3778"
  scope              = "/keys"

  depends_on = [
    azurerm_key_vault_managed_hardware_security_module_role_assignment.hsm_crypto_user,
  ]
}

resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "uai_crypto_user" {
  managed_hsm_id     = azurerm_key_vault_managed_hardware_security_module.this.id
  name               = random_uuid.role_assignments_names[2].result
  principal_id       = azurerm_user_assigned_identity.this.principal_id
  role_definition_id = "/Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/21dbd100-6940-42c2-9190-5d6cb909625b"
  scope              = "/keys"

  depends_on = [
    azurerm_key_vault_managed_hardware_security_module_role_assignment.hsm_crypto_officer,
  ]
}

resource "time_sleep" "role_assignment" {
  create_duration = "30s"

  depends_on = [
    azurerm_key_vault_managed_hardware_security_module_role_assignment.hsm_crypto_user,
    azurerm_key_vault_managed_hardware_security_module_role_assignment.hsm_crypto_officer,
    azurerm_key_vault_managed_hardware_security_module_role_assignment.uai_crypto_user
  ]
}

resource "azurerm_key_vault_managed_hardware_security_module_key" "this" {
  key_opts       = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]
  key_type       = "RSA-HSM"
  managed_hsm_id = azurerm_key_vault_managed_hardware_security_module.this.id
  name           = "cognitiveaccountkey"
  key_size       = 2048

  depends_on = [
    time_sleep.role_assignment
  ]
}

module "test" {
  source = "../../"

  kind                = "AIServices"
  location            = azurerm_resource_group.this.location
  name                = "AIService-${module.naming.cognitive_account.name_unique}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S0"
  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault_managed_hardware_security_module.this.id
    key_name              = azurerm_key_vault_managed_hardware_security_module_key.this.name
    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.this.id
    }
  }
  enable_telemetry = false
  is_hsm_key       = true
  managed_identities = {
    system_assigned            = false
    user_assigned_resource_ids = toset([azurerm_user_assigned_identity.this.id])
  }
}
```

--------------------------------

### Deploy Azure AI Document Intelligence Account

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Document-Intelligence/README.md

This Terraform configuration deploys an Azure AI Document Intelligence service account. It specifies the required Terraform and AzureRM provider versions, sets up a resource group, and utilizes a module to provision the cognitive services account with a specified SKU and name.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}


# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "East US"
  name     = "avm-res-cognitiveservices-account-${module.naming.resource_group.name_unique}"
}

module "test" {
  source = "../../"

  kind                = "FormRecognizer"
  location            = azurerm_resource_group.this.location
  name                = "AI-Document-Intelligence-${module.naming.cognitive_account.name_unique}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S0"
  enable_telemetry    = false
}
```

--------------------------------

### Terraform Resources for Naming and Uniqueness

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet covers Terraform resources from the 'random' provider used for generating unique identifiers and strings. These are typically used for creating unique names for resources or for generating random values.

```terraform
resource "random_string" "suffix" {}
resource "random_uuid" "role_assignments_names" {}
```

--------------------------------

### Terraform Resources for Identity and Resource Management

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet includes Terraform resources for managing Azure resource groups and user-assigned identities. These are fundamental for organizing cloud resources and providing managed identities for applications.

```terraform
resource "azurerm_resource_group" "this" {}
resource "azurerm_user_assigned_identity" "this" {}
```

--------------------------------

### Deploy Azure OpenAI Service with Private Endpoint (Terraform)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-private-endpoint/README.md

This Terraform configuration deploys an Azure OpenAI service, including a private endpoint for secure access. It utilizes the Azure/naming module for resource naming and the Azure/vnet/azurerm module for network configuration. The deployment ensures compliance with Azure OpenAI service requirements and network isolation.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}


# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = var.location
  name     = "avm-res-cognitiveservices-account-${module.naming.resource_group.name_unique}"
}

module "vnet" {
  source  = "Azure/vnet/azurerm"
  version = "5.0.1"

  resource_group_name = azurerm_resource_group.this.name
  vnet_location       = azurerm_resource_group.this.location
  address_space       = ["10.52.0.0/16"]
  enable_telemetry    = false
  subnet_names        = ["openai", "app"]
  subnet_prefixes     = ["10.52.0.0/24", "10.52.1.0/24"]
  subnet_service_endpoints = {
    openai = ["Microsoft.CognitiveServices"]
    app    = ["Microsoft.CognitiveServices"]
  }
  use_for_each = true
  vnet_name    = "vnet"
}

resource "azurerm_private_dns_zone" "zone" {
  name                = "privatelink.openai.azure.com"
  resource_group_name = azurerm_resource_group.this.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "link" {
  name                  = "openai-private-dns-zone"
  private_dns_zone_name = azurerm_private_dns_zone.zone.name
  resource_group_name   = azurerm_resource_group.this.name
  virtual_network_id    = module.vnet.vnet_id
}

module "test" {
  source = "../../"

  kind                = "OpenAI"
  location            = azurerm_resource_group.this.location
  name                = "OpenAI-${module.naming.cognitive_account.name_unique}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S0"
  cognitive_deployments = {
    "gpt-4o-mini" = {
      name = "gpt-4o-mini"
      model = {
        format  = "OpenAI"
        name    = "gpt-4o-mini"
        version = "2024-07-18"
      }
      scale = {
        type = "Standard"
      }
    }
  }
  enable_telemetry = false
  network_acls = {
    default_action = "Deny"
    virtual_network_rules = toset([{
      subnet_id = module.vnet.vnet_subnets_name_id["openai"]
    }])
  }
  private_endpoints = {
    pe_endpoint = {
      name                            = "pe_endpoint"
      private_dns_zone_resource_ids   = toset([azurerm_private_dns_zone.zone.id])
      private_service_connection_name = "pe_endpoint_connection"
      subnet_resource_id              = module.vnet.vnet_subnets_name_id["openai"]
    }
  }
}

```

--------------------------------

### Terraform Resource for Time Delays

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet includes the Terraform 'time_sleep' resource, which is used to introduce delays in Terraform deployments. This is often necessary to wait for resources to become available or to manage deployment sequencing.

```terraform
resource "time_sleep" "role_assignment" {}
```

--------------------------------

### Terraform Resources for Key Vault Management

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-AI-Service/README.md

This snippet groups Terraform resources related to Azure Key Vault, including Key Vault itself, certificates, managed hardware security modules (HSMs), and their role assignments. These resources are essential for managing secrets and cryptographic keys securely.

```terraform
resource "azurerm_key_vault" "this" {}
resource "azurerm_key_vault_certificate" "cert" {}
resource "azurerm_key_vault_managed_hardware_security_module" "this" {}
resource "azurerm_key_vault_managed_hardware_security_module_key" "this" {}
resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "hsm_crypto_officer" {}
resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "hsm_crypto_user" {}
resource "azurerm_key_vault_managed_hardware_security_module_role_assignment" "uai_crypto_user" {}
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/default/README.md

Lists the external Terraform providers and their version constraints required for this module to function correctly.

```markdown
## Requirements

The following requirements are needed by this module:

- <a name="requirement_terraform"></a> [terraform](#requirement_terraform) (>= 1.9, < 2.0)

- <a name="requirement_azurerm"></a> [azurerm](#requirement_azurerm) (~> 4.0)
```

--------------------------------

### Terraform Module Optional Inputs

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/default/README.md

Details the optional input variables for the Terraform module, including their types and default values.

```markdown
## Optional Inputs

The following input variables are optional (have default values):

### <a name="input_location"></a> [location](#input_location)

Description: n/a

Type: `string`

Default: `"East US"`
```

--------------------------------

### Cognitive Services Account Module Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/default/README.md

Deploys an Azure Cognitive Services account, specifically configured for OpenAI. It specifies the kind, location, SKU, and defines cognitive deployments like 'gpt-4o-mini'.

```terraform
module "test" {
  source = "../../"

  kind                = "OpenAI"
  location            = azurerm_resource_group.this.location
  name                = "OpenAI-${module.naming.cognitive_account.name_unique}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S0"
  cognitive_deployments = {
    "gpt-4o-mini" = {
      name = "gpt-4o-mini"
      model = {
        format  = "OpenAI"
        name    = "gpt-4o-mini"
        version = "2024-07-18"
      }
      scale = {
        type = "Standard"
      }
    }
  }
  enable_telemetry = false
}
```

--------------------------------

### CognitiveServices Account QnA Runtime Endpoint

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

A URL to link a QnAMaker cognitive account to a QnA runtime. Defaults to null.

```hcl
string
```

--------------------------------

### Resource Group and Naming Convention

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-customer_managed_key_encryption/README.md

Configures a resource group using the azurerm_resource_group resource and leverages a naming module for CAF compliance. A random string is generated for unique resource naming.

```hcl
# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "East US"
  name     = "avm-res-cognitiveservices-account-${module.naming.resource_group.name_unique}"
}

resource "random_string" "suffix" {
  length  = 5
  numeric = false
  special = false
  upper   = false
}
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Lists the required Terraform version and provider versions necessary for this module to function correctly. These dependencies ensure compatibility and access to necessary Azure resources and features.

```terraform
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.5"
    }
    azurerm = {
      source  = "Azure/azurerm"
      version = ">= 4.17.0, < 5.0"
    }
    modtm = {
      source  = "Azure/modtm"
      version = "~> 0.3"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.10"
    }
  }
}
```

--------------------------------

### Terraform and Provider Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-customer_managed_key_encryption/README.md

Defines the required Terraform version and providers, including azurerm and random. It also configures the azurerm provider with specific features for resource group and key vault operations.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}
```

--------------------------------

### Cognitive Services Account Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-customer_managed_key_encryption/README.md

Deploys the Azure Cognitive Services account, specifying its kind (e.g., 'Face'), location, and SKU. It configures customer-managed key encryption using the previously created Key Vault and User Assigned Identity.

```hcl
module "test" {
  source = "../../"

  kind                = "Face"
  location            = azurerm_resource_group.this.location
  name                = "Face-${module.naming.cognitive_account.name_unique}"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "E0"
  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault.this.id
    key_name              = azurerm_key_vault_key.key.name
    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.this.id
    }
  }
  enable_telemetry = false
  managed_identities = {
    system_assigned            = true
    user_assigned_resource_ids = toset([azurerm_user_assigned_identity.this.id])
  }
}
```

--------------------------------

### Cognitive Services Account Metrics Advisor Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Configures specific settings for the Metrics Advisor feature of an Azure Cognitive Services Account, including Azure AD client ID, tenant ID, super user name, and website name.

```APIDOC
metrics_advisor_aad_client_id: string (Optional) - The Azure AD Client ID (Application ID). This attribute is only set when kind is `MetricsAdvisor`. Changing this forces a new resource to be created.
metrics_advisor_aad_tenant_id: string (Optional) - The Azure AD Tenant ID. This attribute is only set when kind is `MetricsAdvisor`. Changing this forces a new resource to be created.
metrics_advisor_super_user_name: string (Optional) - The super user of Metrics Advisor. This attribute is only set when kind is `MetricsAdvisor`. Changing this forces a new resource to be created.
metrics_advisor_website_name: string (Optional) - The website name of Metrics Advisor. This attribute is only set when kind is `MetricsAdvisor`. Changing this forces a new resource to be created.
```

--------------------------------

### Terraform Azure Cognitive Services Account Inputs

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Defines the input variables for the Azure Cognitive Services Account Terraform module. These inputs specify the account's kind, location, name, resource group, SKU, and optional project management settings.

```APIDOC
kind:
  Description: (Optional) Specifies the type of Cognitive Service Account. Possible values include Academic, AIServices, AnomalyDetector, Bing.Autosuggest, Bing.Autosuggest.v7, Bing.CustomSearch, Bing.Search, Bing.Search.v7, Bing.Speech, Bing.SpellCheck, Bing.SpellCheck.v7, CognitiveServices, ComputerVision, ContentModerator, ContentSafety, CustomSpeech, CustomVision.Prediction, CustomVision.Training, Emotion, Face, FormRecognizer, ImmersiveReader, LUIS, LUIS.Authoring, MetricsAdvisor, OpenAI, Personalizer, QnAMaker, Recommendations, SpeakerRecognition, Speech, SpeechServices, SpeechTranslation, TextAnalytics, TextTranslation, and WebLM. Changing this forces a new resource to be created.
  Type: string

location:
  Description: (Required) Specifies the supported Azure location where the resource exists. Changing this forces a new resource to be created.
  Type: string

name:
  Description: (Required) Specifies the name of the Cognitive Service or AI Service Account. Changing this forces a new resource to be created.
  Type: string

resource_group_name:
  Description: (Required) The name of the resource group in which the Cognitive Service or AI Service Account is created. Changing this forces a new resource to be created.
  Type: string

sku_name:
  Description: (Required) Specifies the SKU Name for this Cognitive Service or AI Service Account. Possible values are F0, F1, S0, S, S1, S2, S3, S4, S5, S6, P0, P1, P2, E0 and DC0.
  Type: string

allow_project_management:
  Description: Specifies whether this resource supports project management as child resources, used as containers for access management, data isolation and cost in AI Foundry.
  Type: bool
  Default: false
```

--------------------------------

### Resource Group Definition

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/default/README.md

Defines the Azure resource group where the Cognitive Services account will be deployed. It utilizes a naming module for CAF compliance.

```terraform
# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = var.location
  name     = "avm-res-cognitiveservices-account-${module.naming.resource_group.name_unique}"
}
```

--------------------------------

### Cognitive Services Account Deployment Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Defines the configuration for Cognitive Services Account Deployments in Terraform, including model details, scaling options, and version upgrade policies. Supports various parameters for deployment customization.

```hcl
map(object({
    name                       = string
    rai_policy_name            = optional(string)
    version_upgrade_option     = optional(string, "OnceNewDefaultVersionAvailable")
    dynamic_throttling_enabled = optional(bool, false)
    model = object({
      format  = string
      name    = string
      version = optional(string)
    })
    scale = object({
      capacity = optional(number, 1)
      family   = optional(string)
      size     = optional(string)
      tier     = optional(string)
      type     = string
    })
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

--------------------------------

### Cognitive Services Account Role Assignments Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Configures role assignments for the Cognitive Services account, allowing principals to be granted specific roles. Supports principal ID, role definition, conditions, and delegation.

```APIDOC
input_role_assignments:
  Description: A map of role assignments to create on the <RESOURCE>. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

  - `role_definition_id_or_name` - The ID or name of the role definition to assign to the principal.
  - `principal_id` - The ID of the principal to assign the role to.
  - `description` - (Optional) The description of the role assignment.
  - `skip_service_principal_aad_check` - (Optional) If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.
  - `condition` - (Optional) The condition which will be used to scope the role assignment.
  - `condition_version` - (Optional) The version of the condition syntax. Leave as `null` if you are not using a condition, if you are then valid values are '2.0'.
  - `delegated_managed_identity_resource_id` - (Optional) The delegated Azure Resource Id which contains a Managed Identity. Changing this forces a new resource to be created. This field is only used in cross-tenant scenario.
  - `principal_type` - (Optional) The type of the `principal_id`. Possible values are `User`, `Group` and `ServicePrincipal`. It is necessary to explicitly set this attribute when creating role assignments if the principal creating the assignment is constrained by ABAC rules that filters on the PrincipalType attribute.

  > Note: only set `skip_service_principal_aad_check` to true if you are assigning a role to a service principal.

  Type:
    map(object({
        role_definition_id_or_name             = string
        principal_id                           = string
        description                            = optional(string, null)
        skip_service_principal_aad_check       = optional(bool, false)
        condition                              = optional(string, null)
        condition_version                      = optional(string, null)
        delegated_managed_identity_resource_id = optional(string, null)
        principal_type                         = optional(string, null)
      }))

  Default: {}
```

--------------------------------

### Cognitive Services Diagnostic Settings Configuration (HCL)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Configures diagnostic settings for Azure Cognitive Services accounts, allowing logs and metrics to be sent to various destinations like Log Analytics, Storage Accounts, or Event Hubs. Supports specifying log categories, metric categories, and destination details.

```hcl
map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))
```

--------------------------------

### Cognitive Services Local Authentication Enablement (HCL)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Controls whether local authentication methods (e.g., API keys) are enabled for the Cognitive Account. Defaults to true, allowing traditional authentication.

```hcl
bool
```

--------------------------------

### Cognitive Services Account Tags Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Applies tags to the Cognitive Services account resource for organization and management purposes.

```APIDOC
input_tags:
  Description: (Optional) A mapping of tags to assign to the resource.

  Type: map(string)

  Default: null
```

--------------------------------

### CognitiveServices Account Private Endpoints Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Defines a map of private endpoints to be created on the Cognitive Service Account, including details on name, role assignments, lock settings, tags, subnet, DNS zones, ASGs, service connections, network interfaces, location, resource group, and IP configurations.

```hcl
map(object({
    name = optional(string, null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    lock = optional(object({
      kind = string
      name = optional(string, null)
    }), null)
    tags                                    = optional(map(string), null)
    subnet_resource_id                      = string
    private_dns_zone_group_name             = optional(string, "default")
    private_dns_zone_resource_ids           = optional(set(string), [])
    application_security_group_associations = optional(map(string), {})
    private_service_connection_name         = optional(string, null)
    network_interface_name                  = optional(string, null)
    location                                = optional(string, null)
    resource_group_name                     = optional(string, null)
    ip_configurations = optional(map(object({
      name               = string
      private_ip_address = string
    })), {})
  }))
```

--------------------------------

### Cognitive Services Customer Managed Key Configuration (HCL)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Defines the configuration for customer-managed keys, including Key Vault resource ID, key name, key version, and user-assigned identity details. This HCL block specifies how to integrate with external Key Vaults for encryption.

```hcl
object({
    key_vault_resource_id = string
    key_name              = string
    key_version           = optional(string, null)
    user_assigned_identity = optional(object({
      resource_id = string
    }), null)
  })
```

--------------------------------

### Cognitive Services Account Storage Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Configures integration with Azure Storage accounts for the Cognitive Services account. Requires the storage account ID and optionally accepts the client ID of an associated managed identity.

```APIDOC
input_storage:
  Description: - `identity_client_id` - (Optional) The client ID of the managed identity associated with the storage resource.
    - `storage_account_id` - (Required) Full resource id of a Microsoft.Storage resource.

  Type:
    list(object({
        identity_client_id = optional(string)
        storage_account_id = string
      }))

  Default: null
```

--------------------------------

### Cognitive Services Allowed FQDNs Configuration (HCL)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Specifies a list of Fully Qualified Domain Names (FQDNs) that are permitted to access the Cognitive Services account. This is used for network access control.

```hcl
list(string)
```

--------------------------------

### Cognitive Services Account RAI Policies Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Configures the RAI (Responsible AI) policies for the Cognitive Services account. Supports defining base policies, modes, content filters with severity thresholds and sources, and custom block lists.

```APIDOC
input_rai_policies:
  Description: - `name` - (Required) The name of the RAI policy. Changing this forces a new resource to be created.
    - `base_policy_name` - (Required) The name of the base policy. Changing this forces a new resource to be created.
    - `mode` - Rai policy mode. The enum value mapping is as below: `Default`, `Deferred`, `Blocking`, `Asynchronous_filter`. Please use 'Asynchronous_filter' after 2024-10-01. It is the same as 'Deferred' in previous version.

  `content_filters` block supports the following:
    - `name` - (Required) Name of ContentFilter.
    - `enabled` - (Required) If the ContentFilter is enabled.
    - `severity_threshold` - (Required) Level at which content is filtered. Possible values are `Low`, `Medium`, `High`.
    - `blocking` - (Required) If blocking would occur.
    - `source` - (Required) Content source to apply the Content Filters. Possible values are `Prompt`, `Completion`.

  `custom_block_lists` block supports the following:
    - `source` - (Required) Content source to apply the Custom Block Lists. Possible values are `Prompt`, `Completion`.
    - `block_list_name` - (Required) Name of ContentFilter.
    - `blocking` - (Required) If blocking would occur.

  Type:
    map(object({
        name             = string
        base_policy_name = string
        mode             = string
        content_filters = optional(list(object({
          blocking           = bool
          enabled            = bool
          name               = string
          severity_threshold = string
          source             = string
        })))
        custom_block_lists = optional(list(object({
          source          = string
          block_list_name = string
          blocking        = bool
        })))
      }))

  Default: {}
```

--------------------------------

### CognitiveServices Account Manage DNS Zone Group

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Controls whether the module manages private DNS zone groups for private endpoints. If set to false, external management is required.

```hcl
bool
```

--------------------------------

### User Assigned Identity and Key Vault Key

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/examples/Azure-OpenAI-with-customer_managed_key_encryption/README.md

Creates a user-assigned managed identity for the service and generates an RSA key within the Key Vault. The key is configured with specific permissions and a rotation policy.

```hcl
resource "azurerm_user_assigned_identity" "this" {
  location            = azurerm_resource_group.this.location
  name                = "uai-zjhe-cog"
  resource_group_name = azurerm_resource_group.this.name
}

resource "azurerm_key_vault_key" "key" {
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
  key_type     = "RSA"
  key_vault_id = azurerm_key_vault.this.id
  name         = "generated-certificate"
  key_size     = 2048

  rotation_policy {
    expire_after         = "P90D"
    notify_before_expiry = "P29D"

    automatic {
      time_before_expiry = "P30D"
    }
  }
}
```

--------------------------------

### Cognitive Services Dynamic Throttling Enablement (HCL)

Source: https://github.com/azure/terraform-azurerm-avm-res-cognitiveservices-account/blob/main/README.md

Controls whether dynamic throttling is enabled for the Cognitive Services account. When enabled, the service can automatically adjust throttling rates based on usage patterns.

```hcl
bool
```