创建OpenAI专用端点失败：账户未设置CustomSubDomainName

尝试为Azure OpenAI服务创建私有端点，参考Terraform文档时看到custom_subdomain_name是可选参数，因此未配置该参数，但执行terraform apply时失败。

Terraform配置 #

resource "azurerm_private_endpoint" "private_endpoint" {
    for_each = {for private_endpoint in local.private_endpoint_list : "${private_endpoint.name}" => private_endpoint}
  name                = ...     
  location            = ..
  resource_group_name = ..
  subnet_id           = ..

  private_dns_zone_group {
    name                 = ...        
    private_dns_zone_ids = ["/subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/privateDnsZones/privatelink.openai.azure.com"]
  }

  private_service_connection {
    name                           = ...    
    private_connection_resource_id = azurerm_cognitive_account.openai_services[each.value.name].id
    is_manual_connection           = false
    subresource_names              = [each.value.subresource_name]
  }
}

错误信息 #

Error: creating Private Endpoint (Subscription: "xxx"
Resource Group Name: "yyy"
Private Endpoint Name: "xxx-oai-service-account"): performing CreateOrUpdate: unexpected status 400 with error: AccountCustomSubDomainNameNotSet: Call to Microsoft.CognitiveServices/accounts failed. Error message: Account /subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.CognitiveServices/accounts/xxx-oai-service doesn't have CustomSubDomainName

  with module.openai_service.azurerm_private_endpoint.private_endpoint["xxx-oai-service-pe-account"],
  on ../modules/LandingZone/AIKM/openai_service/main.tf line 84, in resource "azurerm_private_endpoint" "private_endpoint":
  84: resource "azurerm_private_endpoint" "private_endpoint" {

##[error]Bash exited with code '1'.
##[section]Finishing: Terraform Apply

解决方案 #

虽然Terraform文档标注custom_subdomain_name为可选参数，但当为Azure OpenAI（属于Cognitive Services账户）配置私有端点时，该参数是必填项——Azure要求这类账户必须有全局唯一的自定义子域名才能关联私有端点。

修复步骤：

1. 在你的azurerm_cognitive_account资源配置中添加custom_subdomain_name参数，值需是全局唯一的字符串（不能和其他Azure OpenAI账户重复）。
2. 重新执行terraform apply。

示例修改后的Cognitive Account配置：

resource "azurerm_cognitive_account" "openai_services" {
  name                = "xxx-oai-service"
  resource_group_name = "yyy"
  location            = "eastus"
  sku_name            = "S0"
  kind                = "OpenAI"
  custom_subdomain_name = "your-unique-subdomain-name" # 新增该行，确保全局唯一
  # 其他已有配置...
}

添加该参数后，Azure会为你的OpenAI账户生成形如https://your-unique-subdomain-name.openai.azure.com的端点，私有端点就能正常创建关联了。

内容的提问来源于stack exchange，提问作者RSW