Azure OpenAI DeploymentNotFound — deployment truly missing or unreachable

"""Diagnose a persistent DeploymentNotFound. Prints a verdict."""
import os
import sys
from urllib.parse import urlparse
from azure.identity import DefaultAzureCredential
from azure.mgmt.cognitiveservices import CognitiveServicesManagementClient
from azure.core.exceptions import ResourceNotFoundError

endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]
deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT"]
subscription_id = os.environ["AZURE_SUBSCRIPTION_ID"]

# Parse resource name from endpoint URL
host = urlparse(endpoint).hostname
if not host or not host.endswith(".openai.azure.com"):
    print(f"VERDICT: Endpoint hostname is malformed: {host!r}")
    sys.exit(1)
resource_name = host.split(".")[0]

print(f"Endpoint: {endpoint}")
print(f"Resource name (parsed): {resource_name}")
print(f"Deployment (from env): {deployment_name}")
print(f"Subscription: {subscription_id}")

credential = DefaultAzureCredential()
client = CognitiveServicesManagementClient(credential, subscription_id)

# Step 1: Does the resource exist in this subscription?
found_resource = None
for account in client.accounts.list():
    if account.name == resource_name and account.kind == "OpenAI":
        found_resource = account
        break

if not found_resource:
    print(f"\nVERDICT: No AOAI resource named '{resource_name}' in subscription {subscription_id}.")
    print("Likely causes: (a) resource deleted, (b) wrong subscription context.")
    print("Available AOAI resources in this subscription:")
    for a in client.accounts.list():
        if a.kind == "OpenAI":
            print(f"  {a.name} in {a.location}")
    sys.exit(1)

rg = found_resource.id.split("/")[4]
print(f"Resource found: {found_resource.name} in {found_resource.location} (rg: {rg})")

# Step 2: List deployments — exact match, case-insensitive match, or nothing?
deployments = list(client.deployments.list(rg, found_resource.name))
print(f"\nDeployments on this resource ({len(deployments)}):")
for d in deployments:
    print(f"  {d.name} -> {d.properties.model.name} v{d.properties.model.version}")

exact = [d for d in deployments if d.name == deployment_name]
case_insensitive = [d for d in deployments if d.name.lower() == deployment_name.lower()]

if exact:
    print(f"\nVERDICT: Deployment '{deployment_name}' exists and endpoint matches.")
    print("This means the 404 is likely propagation (deployment created <5min ago) —")
    print("or an SDK problem. Test with curl to confirm.")
    sys.exit(0)

if case_insensitive:
    match = case_insensitive[0].name
    print(f"\nVERDICT: Case mismatch. Config says '{deployment_name}', actual is '{match}'.")
    print(f"Fix: set AZURE_OPENAI_DEPLOYMENT={match}")
    sys.exit(1)

# Step 3: No match at all
print(f"\nVERDICT: Deployment '{deployment_name}' does not exist on resource '{resource_name}'.")
print("Likely causes:")
print("  - Deployment was deleted (check ARM audit log)")
print("  - Deployment was renamed (check the deployment list above for likely candidates)")
print("  - Wrong endpoint URL (are you sure this is the right resource?)")
print("  - Terraform recreated with a new name — check Terraform state")

# List recent operations on the AOAI resource
RG=my-rg
AOAI=my-aoai-resource
RESOURCE_ID=$(az cognitiveservices account show \
  --name $AOAI -g $RG --query id -o tsv)

# All deployment-scope events in last 14 days
az monitor activity-log list \
  --resource-id $RESOURCE_ID \
  --start-time "$(date -u -d '14 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --query "[?contains(operationName.value, 'deployments')].{time:eventTimestamp, op:operationName.value, status:status.value, caller:caller}" \
  -o table

# Deployment-specific delete events
az monitor activity-log list \
  --resource-id $RESOURCE_ID \
  --start-time "$(date -u -d '14 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --query "[?operationName.value=='Microsoft.CognitiveServices/accounts/deployments/delete/action'].{time:eventTimestamp, caller:caller, status:status.value}" \
  -o table

# When you find the culprit event, drill in
EVENT_ID=<correlationId-from-above>
az monitor activity-log list \
  --correlation-id $EVENT_ID \
  --query "[].{op:operationName.value, caller:caller, ip:callerIpAddress, ua:properties.userAgent}"

# Lock the entire AOAI resource against delete
az lock create \
  --name aoai-no-delete \
  --resource-group my-rg \
  --resource my-aoai-resource \
  --resource-type Microsoft.CognitiveServices/accounts \
  --lock-type CanNotDelete \
  --notes "Blocks accidental delete. Remove only for planned decommission."

# For extra safety, lock the entire resource group
az lock create \
  --name aoai-rg-no-delete \
  --resource-group my-rg \
  --lock-type CanNotDelete

# Verify
az lock list --resource-group my-rg -o table

# Verify Terraform respects the lock (if using Terraform)
# You may need "prevent_destroy = true" in the AOAI resource block