Change Azure OpenAI to use CognitiveServicesOpenAIUser role by default (#10293)

* Change Azure OpenAI to use CognitiveServicesOpenAIUser role by default

The CognitiveServicesOpenAIContributor role is too permissive as it allows an app to modify deployments (i.e. models). Instead we should be defaulting to CognitiveServicesOpenAIUser which allows the app to do inference, but not modify the resources.

* Fix test to test more than the default.

Author: eerhardt

playground/OpenAIEndToEnd/OpenAIEndToEnd.AppHost/openai-roles.module.bicep

@@ -11,11 +11,11 @@ resource openai 'Microsoft.CognitiveServices/accounts@2024-10-01' existing = {
   name: openai_outputs_name
 }
 
-resource openai_CognitiveServicesOpenAIContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(openai.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442'))
+resource openai_CognitiveServicesOpenAIUser 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(openai.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'))
   properties: {
     principalId: principalId
-    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')
     principalType: principalType
   }
   scope: openai

src/Aspire.Hosting.Azure.CognitiveServices/AzureOpenAIExtensions.cs

@@ -97,7 +97,7 @@ public static IResourceBuilder<AzureOpenAIResource> AddAzureOpenAI(this IDistrib
         var resource = new AzureOpenAIResource(name, configureInfrastructure);
         return builder.AddResource(resource)
             .WithDefaultRoleAssignments(CognitiveServicesBuiltInRole.GetBuiltInRoleName,
-                CognitiveServicesBuiltInRole.CognitiveServicesOpenAIContributor);
+                CognitiveServicesBuiltInRole.CognitiveServicesOpenAIUser);
     }
 
 #pragma warning disable CS0618 // Type or member is obsolete

tests/Aspire.Hosting.Azure.Tests/AzureOpenAIExtensionsTests.cs

@@ -93,11 +93,11 @@ param principalId string
               name: openai_outputs_name
             }
 
-            resource openai_CognitiveServicesOpenAIContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-              name: guid(openai.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442'))
+            resource openai_CognitiveServicesOpenAIUser 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+              name: guid(openai.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'))
               properties: {
                 principalId: principalId
-                roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')
+                roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')
                 principalType: principalType
               }
               scope: openai
@@ -106,4 +106,4 @@ param principalId string
         output.WriteLine(openaiRolesManifest.BicepText);
         Assert.Equal(expectedBicep, openaiRolesManifest.BicepText);
     }
-}
+}

tests/Aspire.Hosting.Azure.Tests/RoleAssignmentTests.cs

@@ -54,7 +54,7 @@ public Task OpenAISupport()
                 var openai = builder.AddAzureOpenAI("openai");
 
                 builder.AddProject<Project>("api", launchProfileName: null)
-                    .WithRoleAssignments(openai, CognitiveServicesBuiltInRole.CognitiveServicesOpenAIUser);
+                    .WithRoleAssignments(openai, CognitiveServicesBuiltInRole.CognitiveServicesOpenAIUser, CognitiveServicesBuiltInRole.CognitiveServicesFaceRecognizer);
             });
     }
 

tests/Aspire.Hosting.Azure.Tests/Snapshots/RoleAssignmentTests.OpenAISupport.verified.bicep

@@ -17,4 +17,14 @@ resource openai_CognitiveServicesOpenAIUser 'Microsoft.Authorization/roleAssignm
     principalType: 'ServicePrincipal'
   }
   scope: openai
+}
+
+resource openai_CognitiveServicesFaceRecognizer 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(openai.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7'))
+  properties: {
+    principalId: principalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')
+    principalType: 'ServicePrincipal'
+  }
+  scope: openai
 }