### Configure Search Service Role Assignments Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Assign roles to principals for fine-grained access control on the Azure Search Service. This example demonstrates assigning built-in roles and includes conditional access for specific index operations. ```hcl data "azurerm_client_config" "current" {} module "search_service_rbac" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-rbac-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Configure role assignments role_assignments = { search_contributor = { role_definition_id_or_name = "Search Service Contributor" principal_id = data.azurerm_client_config.current.object_id description = "Full contributor access to search service" skip_service_principal_aad_check = false } search_index_reader = { role_definition_id_or_name = "Search Index Data Reader" principal_id = "00000000-0000-0000-0000-000000000001" description = "Read-only access to search indexes" skip_service_principal_aad_check = true } search_index_contributor = { role_definition_id_or_name = "Search Index Data Contributor" principal_id = "00000000-0000-0000-0000-000000000002" # Optional: Conditional access condition = "@Resource[Microsoft.Search/searchServices/indexes:name] StringEqualsIgnoreCase 'products'" condition_version = "2.0" } } enable_telemetry = true } ``` -------------------------------- ### Basic Azure Search Service Deployment Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Deploys a basic Azure Search service with standard SKU and default settings. Ensure Terraform and the azurerm provider are configured. ```hcl terraform { required_version = ">= 1.9, < 2.0" required_providers { azurerm = { source = "hashicorp/azurerm" version = "~> 4.0" } } } provider "azurerm" { features {} } resource "azurerm_resource_group" "example" { location = "eastus" name = "rg-search-example" } module "search_service" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-example-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" enable_telemetry = true } output "search_service_id" { value = module.search_service.resource_id } output "search_service_endpoint" { value = module.search_service.resource.query_keys } ``` -------------------------------- ### Configure Azure Search SKU and Capacity Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Configures the pricing tier, partition count, replica count, semantic search SKU, and hosting mode for an Azure Search service. Supports various SKUs and scaling options. ```hcl module "search_service_high_capacity" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = "eastus" name = "srch-highcapacity-001" resource_group_name = azurerm_resource_group.example.name # Pricing tier: free, basic, standard, standard2, standard3, # storage_optimized_l1, storage_optimized_l2 sku = "standard2" # Partition count: valid values are 1, 2, 3, 4, 6, 12 # Partitions scale document count and enable faster indexing partition_count = 3 # Replica count: 1-12, minimum 2 for high availability replica_count = 2 # Enable semantic search: "free" or "standard" semantic_search_sku = "standard" # High density hosting mode for up to 1000 indexes hosting_mode = "default" # or "highDensity" enable_telemetry = true } ``` -------------------------------- ### Configure Diagnostic Settings for Azure Search Service Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt This snippet sets up diagnostic settings for an Azure Search Service to send logs and metrics to a Log Analytics workspace and a storage account. Ensure the Log Analytics workspace and storage account resources are defined and accessible. ```hcl resource "azurerm_log_analytics_workspace" "example" { name = "law-search-diagnostics" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "PerGB2018" retention_in_days = 30 } resource "azurerm_storage_account" "diagnostics" { name = "stsearchdiagnostics001" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "LRS" } module "search_service_diagnostics" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-diagnostics-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" diagnostic_settings = { to_log_analytics = { name = "diag-to-law" workspace_resource_id = azurerm_log_analytics_workspace.example.id log_analytics_destination_type = "Dedicated" # Log categories to capture log_categories = [] log_groups = ["allLogs"] # Metric categories to capture metric_categories = ["AllMetrics"] } to_storage = { name = "diag-to-storage" storage_account_resource_id = azurerm_storage_account.diagnostics.id log_groups = ["allLogs"] metric_categories = ["AllMetrics"] } } enable_telemetry = true } ``` -------------------------------- ### Terraform Configuration for Azure Search Service with Private Link Source: https://github.com/azure/terraform-azurerm-avm-res-search-searchservice/blob/main/examples/private-endpoint/README.md This configuration sets up the necessary Terraform providers, locals, and resources to deploy an Azure Search Service with a private endpoint. It includes modules for region and naming, and resources for resource group, virtual network, subnet, and private DNS zones. The search service module is then called with private endpoint configurations. ```hcl terraform { required_version = ">= 1.9, < 2.0" required_providers { azurerm = { source = "hashicorp/azurerm" version = "~>4.0" } random = { source = "hashicorp/random" version = "~>3.5.0" } } } provider "azurerm" { features {} } locals { core_services_vnet_subnets = cidrsubnets("10.0.0.0/22", 6, 2, 4, 3) # name = var.name subnet_address_space = [local.core_services_vnet_subnets[3]] } ## Section to provide a random Azure region for the resource group # This allows us to randomize the region for the resource group. module "regions" { source = "Azure/regions/azurerm" version = "~> 0.3" } # This allows us to randomize the region for the resource group. resource "random_integer" "region_index" { max = length(module.regions.regions) - 1 min = 0 } ## End of section to provide a random Azure region for the resource group # This ensures we have unique CAF compliant names for our resources. module "naming" { source = "Azure/naming/azurerm" version = "~> 0.3" } # This is required for resource modules resource "azurerm_resource_group" "this" { location = var.location name = module.naming.resource_group.name_unique } #VNET for private endpoint resource "azurerm_virtual_network" "this" { location = azurerm_resource_group.this.location name = module.naming.virtual_network.name_unique resource_group_name = azurerm_resource_group.this.name address_space = ["10.0.0.0/22"] tags = var.tags } #Subnet for private endpoint resource "azurerm_subnet" "this" { address_prefixes = local.subnet_address_space name = "aisearch-subnet" resource_group_name = azurerm_resource_group.this.name virtual_network_name = azurerm_virtual_network.this.name private_endpoint_network_policies = "Enabled" } # Create Private DNS Zone for Search Service resource "azurerm_private_dns_zone" "this" { name = "privatelink.search.windows.net" resource_group_name = azurerm_resource_group.this.name tags = var.tags } # Create Private DNS Zone Virtual Network Link resource "azurerm_private_dns_zone_virtual_network_link" "this" { name = "${azurerm_virtual_network.this.name}-link" private_dns_zone_name = azurerm_private_dns_zone.this.name resource_group_name = azurerm_resource_group.this.name virtual_network_id = azurerm_virtual_network.this.id tags = var.tags } # This is the module call # Do not specify location here due to the randomization above. # Leaving location as `null` will cause the module to use the resource group location # with a data source. module "search_service" { source = "../../" # source = "Azure/avm-res-search-searchservice/azurerm" # ... location = azurerm_resource_group.this.location name = module.naming.search_service.name_unique resource_group_name = azurerm_resource_group.this.name allowed_ips = var.azure_ai_allowed_ips enable_telemetry = var.enable_telemetry # see variables.tf local_authentication_enabled = var.local_authentication_enabled managed_identities = { system_assigned = true } private_endpoints = { primary = { private_dns_zone_resource_ids = [azurerm_private_dns_zone.this.id] private_dns_zone_name = azurerm_private_dns_zone.this.name subnet_resource_id = azurerm_subnet.this.id } } public_network_access_enabled = false sku = "standard" } resource "azurerm_private_dns_a_record" "this" { for_each = module.search_service.private_endpoints name = module.search_service.resource.name records = [each.value.private_service_connection[0].private_ip_address] resource_group_name = azurerm_resource_group.this.name ttl = 300 zone_name = azurerm_private_dns_zone.this.name tags = var.tags } ``` -------------------------------- ### Azure Search Private Endpoint Configuration Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Sets up a virtual network, subnet, and private DNS zone for secure Azure Search deployment with private endpoint connectivity. Disables public access and integrates with private DNS. ```hcl # Virtual Network and Subnet resource "azurerm_virtual_network" "example" { location = azurerm_resource_group.example.location name = "vnet-search-example" resource_group_name = azurerm_resource_group.example.name address_space = ["10.0.0.0/22"] } resource "azurerm_subnet" "private_endpoints" { address_prefixes = ["10.0.1.0/24"] name = "snet-private-endpoints" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name private_endpoint_network_policies = "Enabled" } # Private DNS Zone for Search Service resource "azurerm_private_dns_zone" "search" { name = "privatelink.search.windows.net" resource_group_name = azurerm_resource_group.example.name } resource "azurerm_private_dns_zone_virtual_network_link" "search" { name = "search-dns-link" private_dns_zone_name = azurerm_private_dns_zone.search.name resource_group_name = azurerm_resource_group.example.name virtual_network_id = azurerm_virtual_network.example.id } ``` -------------------------------- ### Configure Search Service with Private Endpoint Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Deploy an Azure Search Service with a private endpoint to restrict network access. This configuration disables public network access and sets up private endpoints for secure connectivity. It also manages DNS zone groups automatically. ```hcl module "search_service_private" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-private-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Disable public network access public_network_access_enabled = false # Configure private endpoints private_endpoints = { primary = { subnet_resource_id = azurerm_subnet.private_endpoints.id private_dns_zone_resource_ids = [azurerm_private_dns_zone.search.id] private_dns_zone_group_name = "default" # Optional: Custom naming name = "pe-search-primary" private_service_connection_name = "psc-search-primary" network_interface_name = "nic-pe-search-primary" # Optional: Static IP configuration ip_configurations = { config1 = { name = "ipconfig1" private_ip_address = "10.0.1.10" } } tags = { Environment = "Production" } } } # Let the module manage DNS zone groups private_endpoints_manage_dns_zone_group = true enable_telemetry = true } # Create DNS A record for the private endpoint resource "azurerm_private_dns_a_record" "search" { for_each = module.search_service_private.private_endpoints name = module.search_service_private.resource.name records = [each.value.private_service_connection[0].private_ip_address] resource_group_name = azurerm_resource_group.example.name ttl = 300 zone_name = azurerm_private_dns_zone.search.name } ``` -------------------------------- ### Complete Production Azure Search Deployment Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt This HCL code defines a complete production deployment for an Azure Search service using Terraform. It includes all necessary resources like resource groups, networking, monitoring, and the search service module itself, configured for high availability and security. ```hcl terraform { required_version = ">= 1.9, < 2.0" required_providers { azurerm = { source = "hashicorp/azurerm" version = "~> 4.0" } } } provider "azurerm" { features {} } data "azurerm_client_config" "current" {} resource "azurerm_resource_group" "production" { location = "eastus" name = "rg-search-production" tags = { Environment = "Production" Application = "SearchPlatform" } } # Networking resource "azurerm_virtual_network" "production" { location = azurerm_resource_group.production.location name = "vnet-search-prod" resource_group_name = azurerm_resource_group.production.name address_space = ["10.0.0.0/16"] } resource "azurerm_subnet" "private_endpoints" { address_prefixes = ["10.0.1.0/24"] name = "snet-private-endpoints" resource_group_name = azurerm_resource_group.production.name virtual_network_name = azurerm_virtual_network.production.name private_endpoint_network_policies = "Enabled" } resource "azurerm_private_dns_zone" "search" { name = "privatelink.search.windows.net" resource_group_name = azurerm_resource_group.production.name } resource "azurerm_private_dns_zone_virtual_network_link" "search" { name = "search-vnet-link" private_dns_zone_name = azurerm_private_dns_zone.search.name resource_group_name = azurerm_resource_group.production.name virtual_network_id = azurerm_virtual_network.production.id } # Monitoring resource "azurerm_log_analytics_workspace" "production" { name = "law-search-prod" location = azurerm_resource_group.production.location resource_group_name = azurerm_resource_group.production.name sku = "PerGB2018" retention_in_days = 90 } # Production Search Service module "search_service_production" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.production.location name = "srch-prod-001" resource_group_name = azurerm_resource_group.production.name # High-performance SKU with scaling sku = "standard2" partition_count = 3 replica_count = 3 # Enable semantic search semantic_search_sku = "standard" # Security: Disable public access and local auth public_network_access_enabled = false local_authentication_enabled = false authentication_failure_mode = "http401WithBearerChallenge" # Managed identity for secure access managed_identities = { system_assigned = true } # Private endpoint configuration private_endpoints = { primary = { subnet_resource_id = azurerm_subnet.private_endpoints.id private_dns_zone_resource_ids = [azurerm_private_dns_zone.search.id] name = "pe-search-prod" tags = { Environment = "Production" } } } # Role assignments role_assignments = { admin = { role_definition_id_or_name = "Search Service Contributor" principal_id = data.azurerm_client_config.current.object_id description = "Admin access to search service" } } # Diagnostic settings diagnostic_settings = { production = { name = "diag-prod" workspace_resource_id = azurerm_log_analytics_workspace.production.id log_groups = ["allLogs"] metric_categories = ["AllMetrics"] } } # Resource lock to prevent accidental deletion lock = { kind = "CanNotDelete" name = "production-delete-lock" } # Tags tags = { Environment = "Production" Application = "SearchPlatform" ManagedBy = "Terraform" } enable_telemetry = true } # Outputs output "search_service_id" { description = "The resource ID of the search service" value = module.search_service_production.resource_id } output "search_service_name" { description = "The name of the search service" value = module.search_service_production.resource.name } output "search_service_endpoint" { description = "The search service endpoint URL" value = "https://${module.search_service_production.resource.name}.search.windows.net" } output "private_endpoint_ip" { description = "Private endpoint IP address" value = module.search_service_production.private_endpoints["primary"].private_service_connection[0].private_ip_address } output "search_identity_principal_id" { description = "The principal ID of the system-assigned managed identity" value = module.search_service_production.resource.identity[0].principal_id } ``` -------------------------------- ### Configure Network Access for Azure Search Service Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt This snippet configures network access for an Azure Search Service, enabling public access with IP allowlisting and allowing trusted Azure services to bypass network rules. Ensure your IP addresses are correctly formatted as CIDR blocks. ```hcl module "search_service_network" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-network-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Enable public network access with restrictions public_network_access_enabled = true # Allow specific IP addresses or CIDR blocks allowed_ips = [ "203.0.113.0/24", "198.51.100.42", "192.0.2.0/25" ] # Allow trusted Azure services to bypass network rules # Options: "None" or "AzureServices" network_rule_bypass_option = "AzureServices" enable_telemetry = true } ``` -------------------------------- ### Default Terraform Configuration for Azure Search Service Source: https://github.com/azure/terraform-azurerm-avm-res-search-searchservice/blob/main/examples/default/README.md This HCL code block defines the default Terraform configuration for deploying an Azure Search Service. It includes required providers, a resource group, and the main search service module. Ensure the specified provider versions are compatible with your environment. ```hcl terraform { required_version = ">= 1.9, < 2.0" required_providers { azurerm = { source = "hashicorp/azurerm" version = "~>4.0" } random = { source = "hashicorp/random" version = "~>3.5" } } } provider "azurerm" { features { } } ## Section to provide a random Azure region for the resource group # This allows us to randomize the region for the resource group. module "regions" { source = "Azure/regions/azurerm" version = "~> 0.3" } # This allows us to randomize the region for the resource group. resource "random_integer" "region_index" { max = length(module.regions.regions) - 1 min = 0 } ## End of section to provide a random Azure region for the resource group # This ensures we have unique CAF compliant names for our resources. module "naming" { source = "Azure/naming/azurerm" version = "~> 0.3" } # This is required for resource modules resource "azurerm_resource_group" "this" { location = var.location name = module.naming.resource_group.name_unique } # This is the module call # Do not specify location here due to the randomization above. # Leaving location as `null` will cause the module to use the resource group location # with a data source. module "search_service" { source = "../../" # source = "Azure/avm-res-search-searchservice/azurerm" # ... location = var.location name = module.naming.search_service.name_unique resource_group_name = azurerm_resource_group.this.name # managed_identities = { # system_assigned = true # } enable_telemetry = var.enable_telemetry # see variables.tf sku = "standard" } ``` -------------------------------- ### Configure Search Service with Managed Identity Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Enable system-assigned managed identity for an Azure Search Service. This allows the search service to securely authenticate to other Azure resources without needing explicit credentials. ```hcl module "search_service_identity" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-identity-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Enable system-assigned managed identity managed_identities = { system_assigned = true user_assigned_resource_ids = [] } enable_telemetry = true } output "search_identity_principal_id" { value = module.search_service_identity.resource.identity[0].principal_id } ``` -------------------------------- ### Configure Search Service Authentication Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt Configure authentication settings for Azure Search Service, including disabling local API key authentication to enforce Azure AD-only access and setting the authentication failure response mode. ```hcl module "search_service_auth" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-auth-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Disable API key authentication (enforce Azure AD only) local_authentication_enabled = false # Configure authentication failure response # Options: "http401WithBearerChallenge" or "http403" authentication_failure_mode = "http401WithBearerChallenge" # Enable managed identity for AAD authentication managed_identities = { system_assigned = true } enable_telemetry = true } ``` -------------------------------- ### Apply Resource Lock to Azure Search Service Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt This snippet applies a resource lock to an Azure Search Service to prevent accidental deletion. The 'CanNotDelete' kind prevents deletion but allows modifications. Use 'ReadOnly' to prevent any modifications. ```hcl module "search_service_locked" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-locked-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Apply resource lock # kind: "CanNotDelete" - prevents deletion but allows modifications # kind: "ReadOnly" - prevents any modifications including deletion lock = { kind = "CanNotDelete" name = "delete-lock" # Optional: auto-generated if not specified } enable_telemetry = true } ``` -------------------------------- ### Configure Customer-Managed Key Encryption for Azure Search Service Source: https://context7.com/azure/terraform-azurerm-avm-res-search-searchservice/llms.txt This snippet configures customer-managed key (CMK) encryption for an Azure Search Service using Azure Key Vault. It requires enabling CMK enforcement and providing the Key Vault and key details. A system-assigned managed identity is also required for CMK. ```hcl data "azurerm_client_config" "current" {} resource "azurerm_key_vault" "example" { name = "kv-search-cmk-001" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "standard" purge_protection_enabled = true soft_delete_retention_days = 7 } resource "azurerm_key_vault_key" "search" { name = "search-encryption-key" key_vault_id = azurerm_key_vault.example.id key_type = "RSA" key_size = 2048 key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"] } module "search_service_cmk" { source = "Azure/avm-res-search-searchservice/azurerm" version = "~> 0.1" location = azurerm_resource_group.example.location name = "srch-cmk-001" resource_group_name = azurerm_resource_group.example.name sku = "standard" # Enable CMK enforcement customer_managed_key_enforcement_enabled = true # Configure customer managed key customer_managed_key = { key_vault_resource_id = azurerm_key_vault.example.id key_name = azurerm_key_vault_key.search.name key_version = null # Use latest version } # CMK requires managed identity managed_identities = { system_assigned = true } enable_telemetry = true } ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.