配置Azure OpenAI专用端点后仍遇公共访问禁用报错问题

通过Terraform部署Azure OpenAI Service，已配置专用端点及对应专用DNS区域，但在Azure AI Studio测试GPT-35-turbo模型时，仍收到错误提示：

Public access is disabled. Please configure private endpoint.

原Terraform代码 #

main.tf #

resource "azurerm_resource_group" "rg" {
  location = "westeurope"
  name     = "test-rg"
}

resource "azurerm_cognitive_account" "openai" {
  name                          = "REDACTED"
  location                      = "westeurope"
  resource_group_name           = azurerm_resource_group.rg.name
  kind                          = "OpenAI"
  sku_name                      = "S0"
  custom_subdomain_name         = "REDACTED"
  public_network_access_enabled = false
}

resource "azurerm_virtual_network" "vnet" {
  name                = "test-network"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "private_subnet" {
  name                 = "test-private-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.1.1.0/24"]
  private_endpoint_network_policies_enabled = true
}

resource "azurerm_private_endpoint" "private_endpoint" {
  name                = "test-openai-private-endpoint"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.private_subnet.id

  private_service_connection {
    name                           = "test-openai-privconn"
    private_connection_resource_id = azurerm_cognitive_account.openai.id
    subresource_names              = ["account"]
    is_manual_connection           = false
  }
}

resource "azurerm_private_dns_zone" "openai" {
  name                = "privatelink.openai.azure.com"
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_private_dns_a_record" "openai" {
  name                = "test-openai-private-endpoint"
  zone_name           = "privatelink.openai.azure.com"
  resource_group_name = azurerm_resource_group.rg.name
  ttl                 = 300
  records             = [azurerm_private_endpoint.private_endpoint.private_service_connection[0].private_ip_address]
}

resource "azurerm_private_dns_zone_virtual_network_link" "link" {
  name                  = "test-vnet-link"
  resource_group_name   = azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.openai.name
  virtual_network_id    = azurerm_virtual_network.vnet.id
}

resource "azurerm_cognitive_deployment" "model_gpt_35_turbo" {
  name                 = "test-gpt-35-turbo-model"
  cognitive_account_id = azurerm_cognitive_account.openai.id

  model {
    format  = "OpenAI"
    name    = "gpt-35-turbo"
    version = "0301"
  }

  scale {
    type = "Standard"
  }
}

providers.tf #

terraform {
  required_version = ">=0.12"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.64.0"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "REDACTED"
}

补充信息：未配置自定义DNS服务器，虚拟网络使用Azure默认DNS服务器。

问题分析 #

配置存在两个核心错误：

1. 私有DNS A记录名称错误：Azure OpenAI的私有端点需要将OpenAI账户的custom_subdomain_name作为A记录名称，而非私有端点名称。当前代码用私有端点名称作为A记录名，会导致DNS解析失败，请求无法路由到私有端点。
2. 子网网络策略配置错误：部署私有端点的子网必须禁用private_endpoint_network_policies_enabled，否则默认网络策略会阻断私有端点的流量。

修正后的Terraform代码 #

main.tf #

resource "azurerm_resource_group" "rg" {
  location = "westeurope"
  name     = "test-rg"
}

resource "azurerm_cognitive_account" "openai" {
  name                          = "REDACTED"
  location                      = "westeurope"
  resource_group_name           = azurerm_resource_group.rg.name
  kind                          = "OpenAI"
  sku_name                      = "S0"
  custom_subdomain_name         = "REDACTED"
  public_network_access_enabled = false
}

resource "azurerm_virtual_network" "vnet" {
  name                = "test-network"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "private_subnet" {
  name                 = "test-private-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.1.1.0/24"]
  private_endpoint_network_policies_enabled = false # 修正：禁用私有端点网络策略
}

resource "azurerm_private_endpoint" "private_endpoint" {
  name                = "test-openai-private-endpoint"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.private_subnet.id

  private_service_connection {
    name                           = "test-openai-privconn"
    private_connection_resource_id = azurerm_cognitive_account.openai.id
    subresource_names              = ["account"]
    is_manual_connection           = false
  }
}

resource "azurerm_private_dns_zone" "openai" {
  name                = "privatelink.openai.azure.com"
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_private_dns_a_record" "openai" {
  name                = azurerm_cognitive_account.openai.custom_subdomain_name # 修正：使用OpenAI账户的自定义子域名作为A记录名称
  zone_name           = "privatelink.openai.azure.com"
  resource_group_name = azurerm_resource_group.rg.name
  ttl                 = 300
  records             = [azurerm_private_endpoint.private_endpoint.private_service_connection[0].private_ip_address]
}

resource "azurerm_private_dns_zone_virtual_network_link" "link" {
  name                  = "test-vnet-link"
  resource_group_name   = azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.openai.name
  virtual_network_id    = azurerm_virtual_network.vnet.id
}

resource "azurerm_cognitive_deployment" "model_gpt_35_turbo" {
  name                 = "test-gpt-35-turbo-model"
  cognitive_account_id = azurerm_cognitive_account.openai.id

  model {
    format  = "OpenAI"
    name    = "gpt-35-turbo"
    version = "0301"
  }

  scale {
    type = "Standard"
  }
}

providers.tf #

terraform {
  required_version = ">=0.12"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.64.0"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "REDACTED"
}

验证步骤 #

1. 应用修正后的配置：

   terraform init
   terraform plan
   terraform apply
   

2. 确保测试Azure AI Studio的客户端处于已链接私有DNS区域的虚拟网络内（如通过VPN、专用链接或虚拟机器）。
3. 在虚拟网络内的机器上执行nslookup <your-custom-subdomain>.privatelink.openai.azure.com，确认返回私有端点的私有IP地址。

内容的提问来源于stack exchange，提问作者edo