aml_workspace.tf

# Azure Machine Learning Workspace with Private Endpoints

resource "azurerm_machine_learning_workspace" "aml_ws" {
  name                    = "${var.prefix}-aml-ws-${random_string.postfix.result}"
  location                = azurerm_resource_group.syn_rg.location
  resource_group_name     = azurerm_resource_group.syn_rg.name
  application_insights_id = azurerm_application_insights.syn_ai.id
  key_vault_id            = azurerm_key_vault.syn_kv.id
  storage_account_id      = azurerm_storage_account.syn_ws_sa.id
  container_registry_id   = azurerm_container_registry.syn_acr.id

  identity {
    type = "SystemAssigned"
  }
}

# DNS Zones

resource "azurerm_private_dns_zone" "aml_ws_zone_api" {
  name                = "privatelink.api.azureml.ms"
  resource_group_name = azurerm_resource_group.syn_rg.name
}

resource "azurerm_private_dns_zone" "aml_ws_zone_notebooks" {
  name                = "privatelink.notebooks.azure.net"
  resource_group_name = azurerm_resource_group.syn_rg.name
}

# Linking of DNS zones to Virtual Network

resource "azurerm_private_dns_zone_virtual_network_link" "aml_ws_zone_api_link" {
  name                  = "${random_string.postfix.result}_link_api"
  resource_group_name   = azurerm_resource_group.syn_rg.name
  private_dns_zone_name = azurerm_private_dns_zone.aml_ws_zone_api.name
  virtual_network_id    = azurerm_virtual_network.syn_vnet.id
}

resource "azurerm_private_dns_zone_virtual_network_link" "aml_ws_zone_notebooks_link" {
  name                  = "${random_string.postfix.result}_link_notebooks"
  resource_group_name   = azurerm_resource_group.syn_rg.name
  private_dns_zone_name = azurerm_private_dns_zone.aml_ws_zone_notebooks.name
  virtual_network_id    = azurerm_virtual_network.syn_vnet.id
}

# Private Endpoint configuration

resource "azurerm_private_endpoint" "aml_ws_pe" {
  name                = "${var.prefix}-aml-ws-pe-${random_string.postfix.result}"
  location            = azurerm_resource_group.syn_rg.location
  resource_group_name = azurerm_resource_group.syn_rg.name
  subnet_id           = azurerm_subnet.default_subnet.id

  private_service_connection {
    name                           = "${var.prefix}-aml-ws-psc-${random_string.postfix.result}"
    private_connection_resource_id = azurerm_machine_learning_workspace.aml_ws.id
    subresource_names              = ["amlworkspace"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "private-dns-zone-group-ws"
    private_dns_zone_ids = [azurerm_private_dns_zone.aml_ws_zone_api.id, azurerm_private_dns_zone.aml_ws_zone_notebooks.id]
  }

  # Add Private Link after we configured the workspace and attached AKS
  # depends_on = [null_resource.compute_resouces, azurerm_kubernetes_cluster.aml_aks]
}