动手实验室 — AI-102 Microsoft Azure AI Engineer Associate

概述

先决条件

步骤

1. 1.提供者、资源组、命名原语

   标准的 Azure 开篇。AI-102 要求您使用 eastus 或 westus 以获取最新的 Azure OpenAI 模型可用性——较旧的区域无法快速获得 GPT-4 系列模型。

   复制

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
       random  = { source = "hashicorp/random",  version = "~> 3.6" }
     }
   }
   
   provider "azurerm" {
     features {
       key_vault {
         purge_soft_delete_on_destroy = true
       }
     }
   }
   
   resource "random_id" "suffix" {
     byte_length = 3
   }
   
   data "azurerm_client_config" "current" {}
   
   locals {
     tags = {
       Project   = "certlabpro-ai-102"
       ManagedBy = "terraform"
     }
   }
   
   resource "azurerm_resource_group" "main" {
     name     = "certlabpro-ai-102-rg"
     location = "eastus"
     tags     = local.tags
   }

2. 2.部署带聊天模型部署的 Azure OpenAI 账户

   配置服务：

   • Azure OpenAI Service

   Azure OpenAI 是 AI-102 的生产级 GenAI 引擎。我们创建账户 (kind = "OpenAI") 并部署 gpt-4o-mini 作为聊天模型——这是撰写本文时最便宜的 GPT-4 级别模型，也是 AI-102 实验的推荐默认值。部署是特定模型版本到配额分配的命名绑定；您可以从应用程序代码中按名称调用它。

   model.version = "2024-07-18" 是 gpt-4o-mini 的发布日期——AI-102 将模型版本稳定性作为重复关注的问题进行测试（锁定到特定版本与自动升级）。考试倾向于为生产可靠性明确固定版本。

   复制

   resource "azurerm_cognitive_account" "openai" {
     name                  = "openai-ai102-${random_id.suffix.hex}"
     resource_group_name   = azurerm_resource_group.main.name
     location              = azurerm_resource_group.main.location
     kind                  = "OpenAI"
     sku_name              = "S0"
     custom_subdomain_name = "openai-ai102-${random_id.suffix.hex}"
   
     identity {
       type = "SystemAssigned"
     }
   
     tags = local.tags
   }
   
   resource "azurerm_cognitive_deployment" "chat" {
     name                 = "gpt-4o-mini"
     cognitive_account_id = azurerm_cognitive_account.openai.id
   
     model {
       format  = "OpenAI"
       name    = "gpt-4o-mini"
       version = "2024-07-18"
     }
   
     sku {
       name     = "Standard"
       capacity = 10 # TPM in thousands; 10 = 10K tokens-per-minute quota
     }
   }

3. 3.预置 Azure AI Search 作为检索基础

   配置服务：

   • Azure AI Search

   Azure AI Search（已更名为 Cognitive Search）是 AI-102 RAG 模式的检索引擎。我们预置了一个基本层服务——它支持系统分配的托管标识，这是 Azure AI Search 安全调用 Azure OpenAI 以实现集成向量化功能（AI Search 在索引期间代表您调用嵌入模型）所必需的。

   local_authentication_enabled = false 设置是 AI-102 生产最佳实践答案——强制使用 Entra ID 身份验证，避免管理员密钥随意散布。系统分配的托管标识在下一步中被授予访问 Azure OpenAI 的权限。

   复制

   resource "azurerm_search_service" "main" {
     name                          = "search-ai102-${random_id.suffix.hex}"
     resource_group_name           = azurerm_resource_group.main.name
     location                      = azurerm_resource_group.main.location
     sku                           = "basic"
     replica_count                 = 1
     partition_count               = 1
     local_authentication_enabled  = false # Entra auth only
     public_network_access_enabled = true
   
     identity {
       type = "SystemAssigned"
     }
   
     tags = local.tags
   }
   
   # Grant AI Search's managed identity Cognitive Services OpenAI User on the
   // account — required for integrated vectorization (AI Search → OpenAI embeddings).
   resource "azurerm_role_assignment" "search_to_openai" {
     scope                = azurerm_cognitive_account.openai.id
     role_definition_name = "Cognitive Services OpenAI User"
     principal_id         = azurerm_search_service.main.identity[0].principal_id
   }

4. 4.添加用于源文档的存储账户

   配置服务：

   • Azure Storage

   RAG 的源文档存储在 Azure 存储中。Azure AI Search 索引器从 blob 容器中提取数据，通过 OpenAI 嵌入模型进行向量化处理，并填充搜索索引。在存储账户上授予 AI Search 的托管标识 Storage Blob Data Reader 权限是 AI-102 无密码检索模式。

   通过托管标识将存储、Azure AI Search 和 OpenAI 全部连接起来，RAG 基础结构就位。应用程序层（接收用户查询、调用 Azure AI Search，然后使用检索到的上下文调用 OpenAI 的聊天协调器）是您编写的代码——Terraform 在这方面无能为力；它确保基础设施正确运行。

   复制

   resource "azurerm_storage_account" "docs" {
     name                            = "ai102docs${random_id.suffix.hex}"
     resource_group_name             = azurerm_resource_group.main.name
     location                        = azurerm_resource_group.main.location
     account_tier                    = "Standard"
     account_replication_type        = "LRS"
     account_kind                    = "StorageV2"
   
     https_traffic_only_enabled      = true
     min_tls_version                 = "TLS1_2"
     allow_nested_items_to_be_public = false
   
     tags = local.tags
   }
   
   resource "azurerm_storage_container" "source" {
     name                  = "source"
     storage_account_id    = azurerm_storage_account.docs.id
     container_access_type = "private"
   }
   
   resource "azurerm_role_assignment" "search_to_storage" {
     scope                = azurerm_storage_account.docs.id
     role_definition_name = "Storage Blob Data Reader"
     principal_id         = azurerm_search_service.main.identity[0].principal_id
   }

5. 5.将 OpenAI + Search 终结点存储在 Key Vault 中

   配置服务：

   • Azure Key Vault

   AI-102 要求生产应用程序从 Key Vault 而不是环境变量或配置文件中读取终结点和密钥。我们预置了一个 Key Vault，并将 OpenAI 终结点、部署名称和 Azure AI Search 终结点作为机密存储。在生产环境中，应用程序的托管标识将在此 Key Vault 上拥有 Key Vault Secrets User 权限，以便在启动时读取它们。

   这完成了 AI-102 的实施和集成闭环：每个终结点、每个密钥、每个服务 URL 都通过 Key Vault——机密轮换的单一入口，审计的单一入口。每个额外的 AI-102 模式（文档智能、翻译器、自定义视觉、语音）都以相同的方式连接。

   复制

   resource "azurerm_key_vault" "main" {
     name                       = "kv-ai102-${random_id.suffix.hex}"
     resource_group_name        = azurerm_resource_group.main.name
     location                   = azurerm_resource_group.main.location
     tenant_id                  = data.azurerm_client_config.current.tenant_id
     sku_name                   = "standard"
     enable_rbac_authorization  = true
     soft_delete_retention_days = 7
   
     tags = local.tags
   }
   
   resource "azurerm_role_assignment" "kv_admin_self" {
     scope                = azurerm_key_vault.main.id
     role_definition_name = "Key Vault Administrator"
     principal_id         = data.azurerm_client_config.current.object_id
   }
   
   resource "azurerm_key_vault_secret" "openai_endpoint" {
     name         = "openai-endpoint"
     value        = azurerm_cognitive_account.openai.endpoint
     key_vault_id = azurerm_key_vault.main.id
   
     depends_on = [azurerm_role_assignment.kv_admin_self]
   }
   
   resource "azurerm_key_vault_secret" "openai_deployment" {
     name         = "openai-deployment"
     value        = azurerm_cognitive_deployment.chat.name
     key_vault_id = azurerm_key_vault.main.id
   
     depends_on = [azurerm_role_assignment.kv_admin_self]
   }
   
   resource "azurerm_key_vault_secret" "search_endpoint" {
     name         = "search-endpoint"
     value        = "https://${azurerm_search_service.main.name}.search.windows.net"
     key_vault_id = azurerm_key_vault.main.id
   
     depends_on = [azurerm_role_assignment.kv_admin_self]
   }

清理