Harden deployer private networking and add optional AMPLS for Commercial and Government #1765

Summary

Close private-networking gaps in SimpleChat deployers and provide an administrator opt-in for Azure Monitor Private Link Scope (AMPLS) in Azure Commercial and Azure Government.

Original Gaps

• Redis deployment does not create a private endpoint; Azure Managed Redis is explicitly left public even with private networking enabled.
• Video Indexer private endpoints are associated with the generic Cognitive Services DNS zone instead of privatelink.api.videoindexer.ai in Commercial.
• Application Insights and Log Analytics do not have an opt-in AMPLS deployment path.
• Government Key Vault uses privatelink.vaultcore.azure.us instead of privatelink.vaultcore.usgovcloudapi.net.

Implemented Behavior

• Create Redis private endpoints and correct cloud/offering-specific DNS when private networking is enabled. Preserve bootstrap access needed for deployment configuration, then close public access only after private connectivity is available.
• Use a dedicated Video Indexer DNS zone only in clouds/API profiles that support its private endpoint.
• Add a default-off deployment option for AMPLS, requiring private networking. Connect deployed Application Insights and Log Analytics, create one AMPLS private endpoint, and configure Commercial or Government DNS zones with existing-zone reuse support.
• Document subnet sizing, DNS forwarding, deployment-runner connectivity, and the effect of private-only monitoring on other resources sharing DNS.

Acceptance Criteria

• Managed and classic Redis private endpoints use the correct resource type, group ID, and DNS zones; public deployments remain unchanged.
• Commercial Video Indexer uses privatelink.api.videoindexer.ai; unsupported Government private-endpoint creation remains disabled.
• Government Key Vault DNS is corrected in each supported deployer.
• Administrators can opt into AMPLS in either cloud; default-off and invalid combinations are covered.
• AMPLS connects Application Insights and Log Analytics, supports correct cloud DNS and existing-zone reuse, and accounts for multiple private IPs.
• Focused regression tests and IaC validation pass; docs and deployer version are updated.

Notes

Primary areas: deployers/bicep/main.bicep, modules/privateNetworking.bicep, modules/privateDNSZones.json, modules/redisCache.bicep, AZD parameter and lifecycle wiring; equivalent Terraform/Azure CLI surfaces as applicable.
Microsoft DNS reference: https://learn.microsoft.com/azure/private-link/private-endpoint-dns
AMPLS reference: https://learn.microsoft.com/azure/azure-monitor/fundamentals/private-link-configure
Priority: P1. Size: L. Assignee: paullizer.

Implementation Update

Implementation is committed and ready for review in PR #1767: #1767

• Head: paullizer/private-networking-ampls-1765; base: paullizer-react-v2-ui. Only the feature branch was pushed. The base branch was not directly pushed or merged.
• Commit: 62d4b02
• Application version 0.261.333; deployer 1.0.34.
• Redis private endpoints and final AZD lockdown implemented, Commercial Video Indexer DNS corrected, and Government Key Vault DNS corrected across deployers.
• Optional AMPLS added for both clouds in Bicep/AZD, Terraform, and CLI. Default off, with private-only monitoring, per-zone reuse, shared Blob DNS, and separate Government overflow-zone handling.
• Updated both Visio files in artifacts/, covering ACR, Key Vault, platform subnet, compact subnet sizing, monitoring DNS, and cloud-specific service/Redis labels. Added a diagram companion and Commercial/Government fresh deployment versus compact existing-network tables.
• Release notes include the implementation and the wider Visio updates. Regenerated previously stale release pages without losing any of the 304 historical version sections.

Validation

• 19 focused tests passed across private DNS/AMPLS wiring, Video Indexer region/permissions, and AZD runner-IP prerequisites.
• Bicep compiles and both generated ARM templates match fresh builds.
• Terraform 1.12.2 validation and networking formatting passed using locked providers and no backend.
• CLI and all four Windows AZD hooks parse; mocked CLI tests cover failure/success sequencing and existing endpoint DNS reconciliation.
• Documentation coverage 7/7 and site-quality checks 6/6 passed.
• Release-note integrity confirms all 304 sections; generator freshness and staged whitespace checks passed.

Remaining Review And Deployment Checks

• No live Azure deployment was performed. Validate private DNS, Redis connectivity, monitoring ingestion, and queries in the intended cloud.
• Government's Visio page still contains the Commercial Video Indexer private-zone label. Review/correct that diagram label; the Government API profile intentionally does not provision a Video Indexer PE.
• Separate azd provision / azd deploy workflows require equivalent final Redis lockdown because they do not run postup; reprovisioning reopens Managed Redis bootstrap access until lockdown runs again.
• The compact five-subnet enterprise reference requires explicit endpoint placement/customization; existing-VNet reuse still supplies one shared PE subnet.

This issue remains open pending PR review and deployment validation.