Controlled Access to AI Training Environments in Azure
PythonIn Azure, controlled access to AI training environments often involves the use of Azure Machine Learning workspaces and Azure's network security services to restrict and manage access. The Azure Machine Learning service provides a cloud-based environment where you can prepare data, train models, and deploy ML services securely.
To control access, we need to:
- Create an Azure Resource Group to serve as a logical container for our Azure Machine Learning resources.
- Deploy an Azure Machine Learning Workspace within the resource group.
- Set up a Virtual Network (VNet) with appropriate networking rules to limit access to the training environment.
- Integrate the Machine Learning Workspace with the VNet to ensure the training environment is within the controlled network.
Below is a Pulumi Python program that accomplishes these tasks:
import pulumi from pulumi_azure_native import resources from pulumi_azure_native import machinelearningservices from pulumi_azure_native import network # Create a new resource group for our AI training environment resource_group = resources.ResourceGroup('ai_resource_group') # Create an Azure Machine Learning Workspace # Replace `YOUR_SUBSCRIPTION_ID` with your actual Azure Subscription ID ml_workspace = machinelearningservices.Workspace( 'ml_workspace', resource_group_name=resource_group.name, location=resource_group.location, sku=machinelearningservices.SkuArgs( name='Basic', # Choose the appropriate SKU for your needs. 'Basic' is sufficient for learning. ), identity=machinelearningservices.IdentityArgs( type='SystemAssigned', ), ) # Create a Virtual Network for the AI training environment vnet = network.VirtualNetwork( 'ai_vnet', resource_group_name=resource_group.name, location=resource_group.location, address_space=network.AddressSpaceArgs( address_prefixes=['10.0.0.0/16'], # Define your VNet address space ), ) # Create a Subnet for Azure Machine Learning within the VNet # Replace `YOUR_SUBNET_RANGE` with the subnet range such as '10.0.0.0/24' subnet = network.Subnet( 'ml_subnet', resource_group_name=resource_group.name, virtual_network_name=vnet.name, address_prefix='YOUR_SUBNET_RANGE', delegations=[network.DelegationArgs( name='ml_delegation', service_name='Microsoft.MachineLearningServices/workspaces', )], ) # Integrate Azure Machine Learning Workspace with the Virtual Network workspace_vnet_integration = machinelearningservices.Workspace( 'workspace_vnet_integration', resource_group_name=resource_group.name, name=ml_workspace.name, identity=ml_workspace.identity, location=ml_workspace.location, sku=ml_workspace.sku, workspace_parameters=machinelearningservices.WorkspaceCustomParametersArgs( custom_virtual_network_id=vnet.id, custom_subnet_name=subnet.name, ), opts=pulumi.ResourceOptions(depends_on=[subnet]), ) # Export the Azure Machine Learning Workspace URL pulumi.export('workspace_url', ml_workspace.discovery_url)
Explanation
-
The
resources.ResourceGroup
class is used to create a new resource group, a fundamental building block within Azure that contains all related resources for an Azure solution. -
The
machinelearningservices.Workspace
class represents the Azure Machine Learning workspace, which is the top-level resource for Azure Machine Learning, providing a centralized place to work with all the artifacts you create. -
The
network.VirtualNetwork
andnetwork.Subnet
classes are used to define a virtual network and a subnet that the workspace will be connected to. This is fundamental for controlling access, as these resources allow you to isolate and manage network traffic associated with your ML training environment. -
The workspace is then associated with the VNet and Subnet using the arguments
custom_virtual_network_id
andcustom_subnet_name
. This connection ensures that the Machine Learning Workspace uses the VNet for enhanced security and control. -
The delegation part within the subnet is required for certain Azure services like Azure Machine Learning to be integrated with a subnet.
Lastly, we've exported the
discovery_url
of the workspace to allow users to easily find the endpoint to access Azure Machine Learning services.Remember to replace placeholders like
YOUR_SUBNET_RANGE
with appropriate values that match your networking setup, and provide your actual Azure Subscription ID in place ofYOUR_SUBSCRIPTION_ID
.Once deployed, this infrastructure will provide a secure environment for AI training, restricting access to the resources based on your network rules and configurations. You can further fine-tune access controls and policies through additional network rules or use Azure Role-Based Access Control (RBAC) for fine-grained permissions.