Update AML to enable private IP compute

CHANGELOG.md

@@ -27,6 +27,7 @@ FEATURES:
 
 ENHANCEMENTS:
 * Add support for referencing IP Groups from the Core Resource Group in firewall rules created via the pipeline [#3089](https://github.com/microsoft/AzureTRE/pull/3089)
+* Update Azure Machine Learning Workspace Service to support "no public IP" compute. This is a full rework so upgrades of existing Azure ML Workspace Service deployments are not supported.  [#3052](https://github.com/microsoft/AzureTRE/pull/3052)
 
 BUG FIXES:
 

Makefile

@@ -134,6 +134,7 @@ terraform-deploy:
 	$(call target_title, "Deploying ${DIR} with Terraform") \
 	&& . ${MAKEFILE_DIR}/devops/scripts/check_dependencies.sh env \
 	&& . ${MAKEFILE_DIR}/devops/scripts/load_and_validate_env.sh \
+	&& . ${MAKEFILE_DIR}/devops/scripts/load_env.sh ${DIR}/.env \
 	&& cd ${DIR}/terraform/ && ./deploy.sh
 
 terraform-import:

docs/tre-templates/workspace-services/azure-ml.md

@@ -6,30 +6,11 @@ This service installs the following resources into an existing virtual network w
 
 ![Azure Machine Learning Service](images/aml_service.png)
 
-Any users with the role of `Workspace Researcher` will be assigned the `AzureML Data Scientist` role within the AML workspace.
-
-## Properties
-
-- `display_name` - The name of the Azure Machine Learning workspace.
-- `description` - The description of the Azure Machine Learning workspace.
-- `is_exposed_externally` - If `True`, the Azure Machine Learning workspace is accessible from outside of the worksapce virtual network.
-
+When deploying the service the Azure ML workspace can be exposed publicly or access restricted to the virtual network. Depending on the choice appropriate network security rules are added. This also means that in the public configuration compute instances can be deployed with public IPs, and in the private configuration they must be deployed with no public IP.
 
-## Firewall Rules
-
-Please be aware that the following outbound Firewall rules are opened for the workspace when this service is deployed, including to Azure Storage. This does open the possibility to extract data from a workspace if the user is determined to do so. Work is ongoing to remove some of these requirements:
-
-Service Tags:
-- AzureActiveDirectory
-- AzureResourceManager
-- AzureMachineLearning"
-- Storage.`{AzureRegion}`
-- MicrosoftContainerRegistry
-
-URLs:
-- aadcdn.msftauth.net
-- ml.azure.com
+Any users with the role of `Workspace Researcher` will be assigned the `AzureML Data Scientist` role within the AML workspace.
 
+To ensure AML compute instances are deployed with the appropriate configuration we suggest they are deployed using an Compute Instance User Resource.
 
 ## Prerequisites
 

e2e_tests/test_workspace_services.py

@@ -8,7 +8,7 @@
 pytestmark = pytest.mark.asyncio
 
 workspace_services = [
-    # strings.AZUREML_SERVICE,
+    strings.AZUREML_SERVICE,
     # strings.INNEREYE_SERVICE,
     strings.GITEA_SERVICE,
     strings.MLFLOW_SERVICE,

templates/workspace_services/azureml/.env.sample

@@ -8,3 +8,5 @@ WORKSPACE_ID="__CHANGE_ME__"
 DISPLAY_NAME="__CHANGE_ME__"
 DESCRIPTION="__CHANGE_ME__"
 IS_EXPOSED_EXTERNALLY="false"
+
+ADDRESS_SAPCE="__CHANGE_ME__"

templates/workspace_services/azureml/parameters.json

@@ -34,6 +34,12 @@
         "env": "DESCRIPTION"
       }
     },
+    {
+      "name": "address_space",
+      "source": {
+        "env": "ADDRESS_SPACE"
+      }
+    },
     {
       "name": "is_exposed_externally",
       "source": {

templates/workspace_services/azureml/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-azureml
-version: 0.6.0
+version: 0.7.25
 description: "An Azure TRE service for Azure Machine Learning"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -41,6 +41,9 @@ parameters:
     default: false
     env: IS_EXPOSED_EXTERNALLY
     description: "Determines if the AML workspace will be available over public/internet"
+  - name: address_space
+    type: string
+    description: "Address space for the AML subnets"
   - name: tfstate_resource_group_name
     type: string
     description: "Resource group containing the Terraform state storage account"
@@ -83,7 +86,12 @@ outputs:
     applyTo:
       - install
       - upgrade
-  - name: workspace_services_subnet_address_prefix
+  - name: workspace_address_spaces
+    type: string
+    applyTo:
+      - install
+      - upgrade
+  - name: aml_subnet_address_prefixes
     type: string
     applyTo:
       - install
@@ -93,14 +101,22 @@ outputs:
     applyTo:
       - install
       - upgrade
+  - name: batch_tag
+    type: string
+    applyTo:
+      - install
+      - upgrade
+  - name: mcr_tag
+    type: string
+    applyTo:
+      - install
+      - upgrade
 
 mixins:
   - terraform:
       clientVersion: 1.3.6
   - az:
       clientVersion: 2.37.0
-      extensions:
-        - azure-firewall
 
 install:
   - terraform:
@@ -111,11 +127,9 @@ install:
         tre_resource_id: ${ bundle.parameters.id }
         display_name: ${ bundle.parameters.display_name }
         description: ${ bundle.parameters.description }
+        address_space: ${ bundle.parameters.address_space }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
         arm_tenant_id: ${ bundle.credentials.azure_tenant_id }
-        arm_client_id: ${ bundle.credentials.azure_client_id }
-        arm_client_secret: ${ bundle.credentials.azure_client_secret }
-        arm_use_msi: ${ bundle.parameters.arm_use_msi }
         auth_client_id: ${ bundle.credentials.auth_client_id }
         auth_client_secret: ${ bundle.credentials.auth_client_secret }
         auth_tenant_id: ${ bundle.credentials.auth_tenant_id }
@@ -130,8 +144,11 @@ install:
         - name: azureml_storage_account_id
         - name: connection_uri
         - name: internal_connection_uri
-        - name: workspace_services_subnet_address_prefix
+        - name: workspace_address_spaces
+        - name: aml_subnet_address_prefixes
         - name: storage_tag
+        - name: batch_tag
+        - name: mcr_tag
 
 upgrade:
   - terraform:
@@ -142,11 +159,9 @@ upgrade:
         tre_resource_id: ${ bundle.parameters.id }
         display_name: ${ bundle.parameters.display_name }
         description: ${ bundle.parameters.description }
+        address_space: ${ bundle.parameters.address_space }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
         arm_tenant_id: ${ bundle.credentials.azure_tenant_id }
-        arm_client_id: ${ bundle.credentials.azure_client_id }
-        arm_client_secret: ${ bundle.credentials.azure_client_secret }
-        arm_use_msi: ${ bundle.parameters.arm_use_msi }
         auth_client_id: ${ bundle.credentials.auth_client_id }
         auth_client_secret: ${ bundle.credentials.auth_client_secret }
         auth_tenant_id: ${ bundle.credentials.auth_tenant_id }
@@ -161,8 +176,11 @@ upgrade:
         - name: azureml_storage_account_id
         - name: connection_uri
         - name: internal_connection_uri
-        - name: workspace_services_subnet_address_prefix
+        - name: workspace_address_spaces
+        - name: aml_subnet_address_prefixes
         - name: storage_tag
+        - name: batch_tag
+        - name: mcr_tag
 
 uninstall:
   - terraform:
@@ -173,11 +191,9 @@ uninstall:
         tre_resource_id: ${ bundle.parameters.id }
         display_name: ${ bundle.parameters.display_name }
         description: ${ bundle.parameters.description }
+        address_space: ${ bundle.parameters.address_space }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
-        arm_use_msi: ${ bundle.parameters.arm_use_msi }
         arm_tenant_id: ${ bundle.credentials.azure_tenant_id }
-        arm_client_id: ${ bundle.credentials.azure_client_id }
-        arm_client_secret: ${ bundle.credentials.azure_client_secret }
         auth_client_id: ${ bundle.credentials.auth_client_id }
         auth_client_secret: ${ bundle.credentials.auth_client_secret }
         auth_tenant_id: ${ bundle.credentials.auth_tenant_id }