Terraform: Deploy Azure OpenAI Service And GPT-35-Turbo

Last Updated on April 15, 2024 by Arnav Sharma

In the rapidly evolving artificial intelligence, leveraging powerful AI models like OpenAI’s GPT series has become a cornerstone for developing intelligent applications. Microsoft Azure provides a platform through its Azure OpenAI Service, allowing users to deploy and manage AI models efficiently. This blog provides a step-by-step guide on using HashiCorp Terraform to provision the Azure OpenAI Service, thereby simplifying the integration of advanced AI capabilities into your applications.

Prerequisites

Before diving into the Terraform script, ensure you have the following prerequisites in place:

• Azure Subscription: You need a valid Azure subscription where you can deploy resources.
• Terraform Installed: Ensure you have Terraform installed on your machine.
• Azure CLI: The Azure CLI is required for Azure authentication purposes.

Step 1: Configure Terraform Azure Providers

The first step is to configure Terraform with the necessary providers. For deploying the Azure OpenAI Service, we primarily use the azurerm provider.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
  }
  required_version = ">= 0.14"
}

provider "azurerm" {
  features {}
}

This configuration block sets up the AzureRM provider, specifying version constraints and the required Terraform version.

Step 2: Define the Resource Group

A resource group in Azure is a container that holds related resources for an Azure solution. Here, we define a resource group for our OpenAI service:

resource "azurerm_resource_group" "openai_rg" {
  name     = "OpenAI-ResourceGroup"
  location = "East US"
}

Step 3: Create Azure OpenAI Service

With the resource group in place, the next step is to create the Azure OpenAI Service instance. We use the azurerm_cognitive_account resource type, setting the kind to OpenAI to specify that this account will host an instance of the OpenAI models.

resource "azurerm_cognitive_account" "openai_service" {
  name                = "openai-service"
  location            = azurerm_resource_group.openai_rg.location
  resource_group_name = azurerm_resource_group.openai_rg.name
  kind                = "OpenAI"
  sku_name            = "S0"  # Standard tier

  properties {
    public_network_access_enabled = true
  }

  tags = {
    environment = "production"
  }
}

This configuration creates a cognitive service account tailored for OpenAI applications, in the standard pricing tier.

Step 4: Output Configuration

After provisioning the resources, it’s helpful to output the configuration details. This enables easy access to important information, such as the endpoint of the OpenAI service.

output "openai_service_endpoint" {
  value = azurerm_cognitive_account.openai_service.endpoint
}

output "openai_service_primary_key" {
  value = azurerm_cognitive_account.openai_service.primary_access_key
}

output "openai_service_primary_key" {
  value = azurerm_cognitive_account.openai_service.primary_access_key
}

Create GPT-35-Turbo Deployment in Azure OpenAI Service using Terraform

Prerequisites

Before you begin, ensure you have the following:

• An Azure subscription: You need an active subscription where you can deploy resources.
• Terraform installed: Make sure Terraform is installed on your machine.
• Azure CLI installed: Necessary for authenticating to your Azure account.

Step 1: Configure Terraform Providers

You need to set up both the azurerm and azapi providers in Terraform. The azapi provider will allow us to configure resources that are not yet fully supported by the azurerm provider.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
    azapi = {
      source = "azure/azapi"
    }
  }
  required_version = ">= 0.14"
}

provider "azurerm" {
  features {}
}

provider "azapi" {}

The azapi Terraform provider is a specialized tool designed to interface directly with Azure’s REST API, allowing users to manage Azure resources that may not be fully supported or available in the more commonly used azurerm provider. This flexibility makes azapi particularly useful for advanced Azure configurations and for deploying newer or preview features that are accessible via Azure’s REST API but not yet exposed through the standard AzureRM Terraform provider.

Key Features of azapi

Here are some of the key features and uses of the azapi provider:

1. Direct API Access: azapi enables direct interactions with the Azure Management REST API, bypassing the limitations of the existing Terraform providers. It sends raw JSON payloads to the API, which can be dynamically constructed based on Terraform’s configurations.
2. Support for Latest Azure Features: Since new features in Azure are exposed through the REST API before they are integrated into the azurerm provider, azapi allows users to implement these features without waiting for provider updates.
3. Custom Resource Management: Users can manage virtually any Azure resource with azapi as long as there is API support for that resource, offering extensive customizability and control over Azure deployments.
4. Complementary to AzureRM: Rather than replacing azurerm, azapi is often used alongside it to manage resources that are not yet supported by azurerm, making it a powerful complement to the capabilities already available in Terraform for Azure.

How It Works

The azapi provider works by making HTTP requests to the Azure Management REST API. It uses the Azure Active Directory for authentication, similar to other Azure services. Here’s a brief overview of how azapi operates:

• Initialization: Like other Terraform providers, you declare and configure the azapi provider in your Terraform scripts.
• Resource Definition: You define resources using the azapi_resource block, where you specify the API endpoint, the type of the resource, and other necessary details.
• Resource Configuration: Instead of predefined properties, you use a JSON blob (body) to configure the resource’s properties according to the schema expected by the Azure API.

Step 2: Define Azure Resources

First, define the resource group and the Azure Cognitive Services account that will host the OpenAI instance.

resource "azurerm_resource_group" "openai_rg" {
  name     = "OpenAI-ResourceGroup"
  location = "East US"
}

resource "azurerm_cognitive_account" "openai_service" {
  name                = "openai-service"
  location            = azurerm_resource_group.openai_rg.location
  resource_group_name = azurerm_resource_group.openai_rg.name
  kind                = "OpenAI"
  sku_name            = "S0"
}

Step 3: Deploy GPT-35-Turbo Model

Now, deploy the GPT-35-turbo model using the azapi_resource resource. This resource allows us to make direct REST API calls to Azure to create and manage Azure resources.

resource "azapi_resource" "gpt_35_turbo_deployment" {
  type = "Microsoft.CognitiveServices/accounts/deployments@2023-05-01"
  name = "gpt-35-turbo-deployment"
  parent_id = azurerm_cognitive_account.openai_service.id

  body = jsonencode({
    properties = {
      model = {
        format = "OpenAI"
        name = "gpt-35-turbo"
        version = "0613"
      },
      versionUpgradeOption = "OnceCurrentVersionExpired",
      raiPolicyName = "Microsoft.Default"
    },
    sku = {
      capacity = 120  # Adjust capacity based on your needs
      name = "Standard"
    }
  })
}

This configuration creates a deployment for the GPT-35-turbo model within your Azure OpenAI service account. It sets the model details and specifies the SKU for the deployment, which determines the capacity and scale settings.

Step 4: Outputs

Finally, to easily retrieve important information about your deployment, configure outputs as follows:

output "openai_service_endpoint" {
  value = azurerm_cognitive_account.openai_service.endpoint
}

output "openai_service_primary_key" {
  value = azurerm_cognitive_account.openai_service.primary_access_key
}

output "gpt_35_turbo_deployment_id" {
  value = azapi_resource.gpt_35_turbo_deployment.id
}

FAQ: Azure Open AI

Q: How can you deploy the infrastructure for an AI service using Azure?

A: To deploy the infrastructure for an AI service using Azure, you can use Terraform, an infrastructure as code tool, to automate the setup. Begin by writing Terraform code that defines the required resources such as compute instances, storage accounts, and networking components. Utilize the Azure provider in your Terraform module to connect and provision these resources within your Azure environment. This approach ensures that the deployment of the infrastructure is repeatable and scalable.

Q: What is the purpose of a private endpoint in Azure AI services?

A: A private endpoint in Azure AI services is used to provide a secure and private entry point to Azure services, like Azure Cognitive Services. It ensures that data transmitted between your Azure service and Azure AI does not traverse the public internet, enhancing security by reducing exposure to potential threats. This setup is particularly critical for applications requiring stringent data privacy and compliance standards.

Q: How can Terraform Module be used to manage Azure OpenAI resources?

A: Terraform can manage Azure OpenAI resources by utilizing the Terraform Azure provider to define and deploy Azure OpenAI-specific resources, such as the Azure OpenAI Studio and various AI models. The process involves writing Terraform code and using the Terraform registry to pull the necessary modules that handle the setup and configuration of these resources, streamlining the deployment and management of large language models and other AI services in the Azure cloud.

Q: What are the key components needed to use ChatGPT via Azure’s AI services?

A: To use ChatGPT via Azure’s AI services, you need to set up a few key components:

1. Azure OpenAI Service: Create an Azure OpenAI resource through the Azure portal, which allows access to OpenAI APIs, including ChatGPT.
2. API Key: Obtain an API key from Azure OpenAI to authenticate and interact with the API.
3. Managed Identities: Utilize Azure AD managed identities to securely manage credentials.
4. Private Endpoint: Set up a private endpoint to ensure secure and private API communications.
5. Deployment: Deploy the infrastructure using Terraform to manage these resources efficiently within the Azure environment.

Q: How does integrating Azure AD enhance the security of Azure AI solutions?

A: Integrating Azure AD with Azure AI solutions enhances security by leveraging Azure AD’s robust identity and access management capabilities. This integration allows for the implementation of advanced authentication mechanisms, such as multi-factor authentication and conditional access policies, which protect against unauthorized access. Managed identities offered by Azure AD can be used to securely connect to Azure AI services without managing credentials in code, thus reducing the potential attack surface.

Q: What are the advantages of using Azure over other cloud providers for deploying OpenAI’s language models?

A: Using Azure to deploy OpenAI’s language models offers several advantages:

1. Enterprise-Grade Security: Azure provides comprehensive security features that adhere to strict compliance and privacy standards, which is essential for deploying AI solutions.
2. Global Infrastructure: Azure’s expansive global infrastructure ensures reduced latency and increased reliability for AI applications operating across different regions.
3. Integrated AI Services: Azure AI services offer seamless integration with other Azure offerings, providing a cohesive environment for developing and deploying AI applications.
4. Scalability: Azure supports the scaling of AI models to meet demands efficiently, thanks to its robust compute capabilities and storage solutions.
5. Developer Tools and Ecosystems: Azure’s well-integrated developer tools and ecosystems, such as Azure DevOps and GitHub, facilitate continuous integration and continuous deployment (CI/CD) practices, enhancing productivity and operational efficiency.

Q: How can you automate the deployment of Azure OpenAI using Terraform?

A: Automating the deployment of Azure OpenAI using Terraform involves the following steps:

1. Initialize Terraform: Use terraform init to prepare your Terraform configuration files for deployment.
2. Write Configuration: Develop Terraform code to specify the Azure OpenAI resource, including any necessary network settings like a private endpoint.
3. Plan and Apply: Execute terraform plan to review the deployment plan and terraform apply to create the resources in Azure, automating the deployment process and ensuring consistency across environments.
4. Manage State: Terraform manages the state of your infrastructure, making it easier to track and modify as your requirements evolve. This method not only simplifies the management of Azure AI resources but also ensures that all infrastructure deployments are reproducible and consistent.

Q: How can Azure DevOps and GitHub enhance the management of Terraform code for deploying AI services?

A: Azure DevOps and GitHub significantly enhance the management of Terraform code for deploying AI services by providing robust version control, automated testing, and continuous integration/continuous deployment (CI/CD) pipelines. These tools facilitate collaboration among development teams, maintain a history of changes, and automate the deployment process, thereby increasing efficiency and reducing the likelihood of errors in production environments.

Q: What is the role of managed identities in securing API interactions in Azure AI?

A: Managed identities in Azure play a crucial role in securing API interactions for Azure AI services by automatically handling the management of credentials used to authenticate to Azure services. This eliminates the need to store sensitive credentials in code, reducing the risk of credential leakage and simplifying the credential management lifecycle. This is particularly important for services like Azure OpenAI that interact extensively with other Azure resources.

Q: What are the steps to create an Azure OpenAI resource with a private endpoint using Terraform?

A: To create an Azure OpenAI resource with a private endpoint using Terraform, follow these steps:

1. Define the Resource: Write Terraform code to define the Azure OpenAI resource and specify the subnet_id for the private endpoint to ensure it connects securely to your virtual network.
2. Configure the Private Endpoint: Include configurations that specify the private connection to the Azure OpenAI API, enhancing security by not exposing the API to the public internet.
3. Apply Terraform Configuration: Run terraform apply to deploy the resources as defined in your Terraform configuration. This will set up the Azure OpenAI resource along with the private endpoint fully configured.
4. Verification: Post-deployment, verify the setup through the Azure portal to ensure the private endpoint is correctly configured and operational.

Q: How does natural language processing integrate with Azure’s cognitive services?

A: Natural language processing (NLP) integrates seamlessly with Azure’s cognitive services to provide advanced text analysis capabilities. Azure cognitive services, like the Text Analytics API and Language Understanding (LUIS), utilize NLP to interpret and manage human language, enabling applications to understand sentences, sentiment, key phrases, and more. This integration is vital for building intelligent applications that can interact naturally with users and process large volumes of text efficiently.

Q: Describe the process to access Azure AI services using managed identities and Azure AD.

A: To access Azure AI services using managed identities and Azure AD, follow these steps:

1. Enable Managed Identities: For your Azure resource (e.g., Azure Function or VM), enable managed identities in the Azure portal.
2. Configure Azure AD: Set up Azure AD to manage identities and assign the necessary roles to the managed identity for accessing specific Azure AI services.
3. Access AI Services: Use the managed identity in your application to securely access Azure AI services without needing to manage credentials, significantly simplifying the authentication process and enhancing security.

Q: What is required to successfully deploy GPT-4 models using Microsoft Azure OpenAI?

A: To successfully deploy GPT-4 models using Azure OpenAI, you need:

1. Azure Subscription and Resource Setup: Create an Azure OpenAI resource in the Azure portal.
2. API Access Setup: Obtain the API key from Azure to interact with the OpenAI API.
3. Network Configuration: Set up a private endpoint if required to secure the connection.
4. Terraform Automation: Use Terraform to automate the deployment and management of the Azure resources, including the GPT-4 models.
5. Performance Optimization: Configure and optimize the Azure environment to support the intensive computational demands of GPT-4 models, including selecting the appropriate Azure region and scaling settings.