Support for content filters

[dkmiller]

Is there an existing issue for this?

• I have searched the existing issues

Description

Azure OpenAI has introduced the ability to configure content filters (How to configure content filters with Azure OpenAI Service).

Terraform already supports specifying a custom policy name via rai_policy_name. However, it does not appear that Terraform currently supports creating custom policies.

The underlying REST call made to create a new content filter is looks like below.

PUT https://management.azure.com/subscriptions/5001b330-4456-4782-8a95-5be13fe6f00a/resourceGroups/my-resource-group/providers/Microsoft.CognitiveServices/accounts/my-openai-account/raiPolicies/MyCustomRaiPolicy?api-version=2023-06-01-preview

with a body like

{
  "name": "Test",
  "displayName": "",
  "properties": {
    "basePolicyName": "Microsoft.Default",
    "type": "UserManaged",
    "contentFilters": [
      {
        "name": "hate",
        "blocking": false,
        "enabled": true,
        "allowedContentLevel": "medium",
        "source": "prompt"
      },
      {
        "name": "sexual",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "high",
        "source": "prompt"
      },
      {
        "name": "selfharm",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "low",
        "source": "prompt"
      },
      {
        "name": "violence",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "medium",
        "source": "prompt"
      },
      {
        "name": "hate",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "low",
        "source": "completion"
      },
      {
        "name": "sexual",
        "blocking": false,
        "enabled": true,
        "allowedContentLevel": "medium",
        "source": "completion"
      },
      {
        "name": "selfharm",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "medium",
        "source": "completion"
      },
      {
        "name": "violence",
        "blocking": true,
        "enabled": true,
        "allowedContentLevel": "high",
        "source": "completion"
      }
    ]
  }
}

New or Affected Resource(s)/Data Source(s)

azurerm_cognitive_rai_policy

Potential Terraform Configuration

resource "azurerm_cognitive_rai_policy" "my_policy" {
  name                 = "MyCustomRaiPolicy"
  display_name         = "My custom RAI policy"
  cognitive_account_id = "/subscriptions/5001b330-4456-4782-8a95-5be13fe6f00a/resourceGroups/my-resource-group/providers/Microsoft.CognitiveServices/accounts/my-openai-account"
  content_filters = [
    {
      name = "hate"
      blocking = false
      enabled = true // This is the default.
      allowed_content_level = "high"
      source = "prompt"
    },
    {
      name = "sexual"
      blocking = true // This is the default.
      // Omit default value for `enabled`.
      allowed_content_level = "high"
      source = "completion"
    }
  ]
}

References

RBAC docs for Microsoft.CognitiveServices/accounts/raiPolicies/*: https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations

[zioproto]

hello @dkmiller ,
thanks for opening this issue.

Looking at the azurerm_cognitive_deployment resource in the module:

terraform-azurerm-openai/main.tf

Lines 74 to 89 in 8ba0434

	resource "azurerm_cognitive_deployment" "this" {
	for_each = var.deployment
	cognitive_account_id = azurerm_cognitive_account.this.id
	name = each.value.name
	rai_policy_name = each.value.rai_policy_name
	model {
	format = each.value.model_format
	name = each.value.model_name
	version = each.value.model_version
	}
	scale {
	type = each.value.scale_type
	}
	}

We could implement a PR to configure the rai_policy_name argument that now is not supported by this module.

Please let me know if you are you interested in proposing a PR for supporting this argument ?

Your proposal for custom policies requires the implementation of a new resource azurerm_cognitive_rai_policy. This request does not belong to this repository. You should open an issue for a new resource at the hashicorp/terraform-provider-azurerm repository.

Thank you

[dkmiller]

Hi @zioproto, this module already supports rai_policy_name per the docs:

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cognitive_deployment#rai_policy_name

Thanks for the heads-up, I'll open an issue in the repository you linked.

[dkmiller]

@zioproto done here: hashicorp/terraform-provider-azurerm#22822. Should I close this out?

[zioproto]

Hi @zioproto, this module already supports rai_policy_name per the docs:

You are right ! I missed this line when reading the code:

terraform-azurerm-openai/main.tf

Line 79 in 8ba0434

rai_policy_name = each.value.rai_policy_name

[zioproto]

@zioproto done here: hashicorp/terraform-provider-azurerm#22822. Should I close this out?

I understand you want to introduce some changes in this Terraform module once the provider eventually supports the new resource azurerm_cognitive_rai_policy, correct ? I suggest to keep this Issue in stand-by while we track what happens in the provider repo. Thanks

[dkmiller]

@zioproto I don't believe any changes will be needed here once the provider supports azurerm_cognitive_rai_policy. Once that change happens, I'll be able to create + reference new RAI policies in a single Terraform module without any additional changes here.

[zioproto]

Thanks for clarifying. I think you we close this Issue then. Thank you