sdk/python/endpoints/online/managed/managed-identities/online-endpoints-managed-identity-sai.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Access Azure resources from an online endpoint with a system-assigned managed identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Additional packages are required for this example:\n",
    "\n",
    "* Microsoft Azure Storage Management Client \n",
    "* Microsoft Azure Authorization Management Client\n",
    "\n",
    "Install them with the following code:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "install-packages"
   },
   "outputs": [],
   "source": [
    "%pip install --pre azure-mgmt-storage\n",
    "%pip install --pre azure-mgmt-authorization"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 1. Configure variables"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 1.1 Assign variables for the workspace and deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "1-assign-variables"
   },
   "outputs": [],
   "source": [
    "subscription_id = \"<SUBSCRIPTION_ID>\"\n",
    "resource_group = \"<RESOURCE_GROUP>\"\n",
    "workspace_name = \"<AML_WORKSPACE_NAME>\"\n",
    "endpoint_name = \"<ENDPOINT_NAME>\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 1.2 Specify the storage details and file to access\n",
    "A text file is located in the `managed-identities` folder called `hello.txt`. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "1-specify-storage-details"
   },
   "outputs": [],
   "source": [
    "storage_account_name = \"<STORAGE_ACCOUNT_NAME>\"\n",
    "storage_container_name = \"<CONTAINER_TO_ACCESS>\"\n",
    "file_name = \"<FILE_TO_ACCESS>\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import random\n",
    "\n",
    "rand = random.randint(0, 10000)\n",
    "\n",
    "endpoint_name = f\"endpt-moe-{rand}\"\n",
    "storage_account_name = f\"oepstorage{rand}\"\n",
    "storage_container_name = f\"hellocontainer\"\n",
    "file_name = \"hello.txt\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 1.3 Retrieve the workspace location:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "1-retrieve-workspace-location"
   },
   "outputs": [],
   "source": [
    "from azure.ai.ml import MLClient\n",
    "from azure.identity import AzureCliCredential\n",
    "from azure.ai.ml.entities import (\n",
    "    ManagedOnlineDeployment,\n",
    "    ManagedOnlineEndpoint,\n",
    "    Model,\n",
    "    CodeConfiguration,\n",
    "    Environment,\n",
    ")\n",
    "\n",
    "credential = AzureCliCredential()\n",
    "ml_client = MLClient(credential, subscription_id, resource_group, workspace_name)\n",
    "\n",
    "workspace_location = ml_client.workspaces.get(workspace_name).location"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 2. Configure deployment"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 2.1 Define an endpoint configuration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "2-define-endpoint-configuration"
   },
   "outputs": [],
   "source": [
    "endpoint = ManagedOnlineEndpoint(name=endpoint_name, auth_mode=\"key\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 2.2 Define a deployment configuration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "2-define-deployment-configuration"
   },
   "outputs": [],
   "source": [
    "deployment = ManagedOnlineDeployment(\n",
    "    name=\"blue\",\n",
    "    endpoint_name=endpoint_name,\n",
    "    model=Model(path=\"../../model-1/model/\"),\n",
    "    code_configuration=CodeConfiguration(\n",
    "        code=\"../../model-1/onlinescoring/\", scoring_script=\"score_managedidentity.py\"\n",
    "    ),\n",
    "    environment=Environment(\n",
    "        conda_file=\"../../model-1/environment/conda-managedidentity.yml\",\n",
    "        image=\"mcr.microsoft.com/azureml/openmpi4.1.0-ubuntu20.04:latest\",\n",
    "    ),\n",
    "    instance_type=\"Standard_DS3_v2\",\n",
    "    instance_count=1,\n",
    "    environment_variables={\n",
    "        \"STORAGE_ACCOUNT_NAME\": storage_account_name,\n",
    "        \"STORAGE_CONTAINER_NAME\": storage_container_name,\n",
    "        \"FILE_NAME\": file_name,\n",
    "    },\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 3. Create the managed identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "With a system-assigned managed identity, Azure creates a managed identity on your behalf."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 4. Create storage account and container"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 4.1 Get a handle to the `StorageManagementClient`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "4-get-handle"
   },
   "outputs": [],
   "source": [
    "from azure.mgmt.storage import StorageManagementClient\n",
    "from azure.storage.blob import ContainerClient\n",
    "from azure.mgmt.storage.models import Sku, StorageAccountCreateParameters, BlobContainer\n",
    "\n",
    "credential = AzureCliCredential()\n",
    "storage_client = StorageManagementClient(\n",
    "    credential=credential, subscription_id=subscription_id\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 4.2 Define and create the storage account"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "4-create-storage-account"
   },
   "outputs": [],
   "source": [
    "storage_account_parameters = StorageAccountCreateParameters(\n",
    "    sku=Sku(name=\"Standard_LRS\"),\n",
    "    kind=\"Storage\",\n",
    "    location=workspace_location,\n",
    "    tags={\"NRMS.NSP-extension\": \"ServiceTag-storage\"},\n",
    ")\n",
    "\n",
    "storage_account = storage_client.storage_accounts.begin_create(\n",
    "    resource_group_name=resource_group,\n",
    "    account_name=storage_account_name,\n",
    "    parameters=storage_account_parameters,\n",
    ").result()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 4.3 Create a blob container"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "4-create-blob-container"
   },
   "outputs": [],
   "source": [
    "blob_container = storage_client.blob_containers.create(\n",
    "    resource_group_name=resource_group,\n",
    "    account_name=storage_account_name,\n",
    "    container_name=storage_container_name,\n",
    "    blob_container=BlobContainer(),\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 4.4 Get the storage account key and create a `ContainerClient`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "4-create-container-client"
   },
   "outputs": [],
   "source": [
    "res = storage_client.storage_accounts.list_keys(\n",
    "    resource_group_name=resource_group,\n",
    "    account_name=storage_account_name,\n",
    ")\n",
    "key = res.keys[0].value\n",
    "\n",
    "container_client = ContainerClient(\n",
    "    account_url=storage_account.primary_endpoints.blob,\n",
    "    container_name=storage_container_name,\n",
    "    credential=key,\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 4.5 Upload a blob to the container"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "4-upload-blob"
   },
   "outputs": [],
   "source": [
    "with open(file_name, \"rb\") as f:\n",
    "    container_client.upload_blob(name=file_name, data=f.read())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 5. Create an online endpoint"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 5.1 Create the endpoint"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "5-create-online-endpoint"
   },
   "outputs": [],
   "source": [
    "ml_client.online_endpoints.begin_create_or_update(endpoint).result()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 5.2 Confirm identity details"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "5-get-details"
   },
   "outputs": [],
   "source": [
    "endpoint = ml_client.online_endpoints.get(endpoint_name)\n",
    "print(endpoint.identity.type)\n",
    "print(endpoint.identity.principal_id)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 6. Give access permission to the managed identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 6.1 Get an `AuthorizationManagementClient` to list Role Definitions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "6-get-role-definitions-client"
   },
   "outputs": [],
   "source": [
    "from azure.mgmt.authorization import AuthorizationManagementClient\n",
    "from azure.mgmt.authorization.v2018_01_01_preview.models import RoleDefinition\n",
    "import uuid\n",
    "\n",
    "role_definition_client = AuthorizationManagementClient(\n",
    "    credential=credential,\n",
    "    subscription_id=subscription_id,\n",
    "    api_version=\"2018-01-01-preview\",\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 6.2 Get an `AuthorizationManagementClient` to make Role Assignments"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "6-get-role-assignments-client"
   },
   "outputs": [],
   "source": [
    "from azure.mgmt.authorization.v2020_10_01_preview.models import (\n",
    "    RoleAssignment,\n",
    "    RoleAssignmentCreateParameters,\n",
    ")\n",
    "\n",
    "role_assignment_client = AuthorizationManagementClient(\n",
    "    credential=credential,\n",
    "    subscription_id=subscription_id,\n",
    "    api_version=\"2020-10-01-preview\",\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 6.3 Get System-assigned identity details"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "6-get-sai-details"
   },
   "outputs": [],
   "source": [
    "endpoint = ml_client.online_endpoints.get(endpoint_name)\n",
    "system_principal_id = endpoint.identity.principal_id"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 6.4 Assign `Storage Blob Data Reader`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "6-give-permission-user-storage-account"
   },
   "outputs": [],
   "source": [
    "role_name = \"Storage Blob Data Reader\"\n",
    "scope = storage_account.id\n",
    "\n",
    "role_defs = role_definition_client.role_definitions.list(scope=scope)\n",
    "role_def = next((r for r in role_defs if r.role_name == role_name))\n",
    "\n",
    "role_assignment_client.role_assignments.create(\n",
    "    scope=scope,\n",
    "    role_assignment_name=str(uuid.uuid4()),\n",
    "    parameters=RoleAssignmentCreateParameters(\n",
    "        role_definition_id=role_def.id, principal_id=system_principal_id\n",
    "    ),\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 7. Create a deployment with your configuration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 7.1 Create the deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "7-create-deployment"
   },
   "outputs": [],
   "source": [
    "ml_client.online_deployments.begin_create_or_update(deployment).result()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 7.2 Check the status of the deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "7-check-deployment-status"
   },
   "outputs": [],
   "source": [
    "deployment = ml_client.online_deployments.get(\n",
    "    endpoint_name=endpoint_name, name=deployment.name\n",
    ")\n",
    "print(deployment)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 7.3 Get the deployment logs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "7-get-deployment-logs"
   },
   "outputs": [],
   "source": [
    "ml_client.online_deployments.get_logs(deployment.name, deployment.endpoint_name, 1000)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 7.4 Set traffic to 100% for deployment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "7-set-traffic"
   },
   "outputs": [],
   "source": [
    "endpoint.traffic = {str(deployment.name): 100}\n",
    "ml_client.begin_create_or_update(endpoint).result()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 8. Test the endpoint"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "8-confirm-endpoint-deployed-successfully"
   },
   "outputs": [],
   "source": [
    "sample_data = \"../../model-1/sample-request.json\"\n",
    "ml_client.online_endpoints.invoke(endpoint_name=endpoint_name, request_file=sample_data)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 9. Delete the endpoint and storage account"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 9.1 Delete the endpoint"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "9-delete-endpoint"
   },
   "outputs": [],
   "source": [
    "ml_client.online_endpoints.begin_delete(endpoint_name)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### 9.2 Delete the storage account"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "name": "9-delete-storage-account"
   },
   "outputs": [],
   "source": [
    "storage_client.storage_accounts.delete(\n",
    "    resource_group_name=resource_group, account_name=storage_account_name\n",
    ")"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.10 - SDK V2",
   "language": "python",
   "name": "python310-sdkv2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.4 (main, Mar 31 2022, 08:41:55) [GCC 7.5.0]"
  },
  "vscode": {
   "interpreter": {
    "hash": "916dbcbb3f70747c44a77c7bcd40155683ae19c65e1c03b4aa3499c5328201f1"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}