Chapter 3 of 6
Confirm these prerequisites:
- The approved Azure subscription is recorded as a full Azure subscription resource ID.
- Session 06 has a working APIM route, and the gateway owner controls the policy source.
- Session 11 has the approved Application Insights or Log Analytics telemetry boundary and action group.
- The APIM instance is integrated with Application Insights and custom metrics with dimensions are enabled.
- API Management diagnostic settings can support the chargeback query. Response-body logging can capture sensitive data, so enable it only under the approved telemetry boundary.
- Finance has approved the cost-center taxonomy, APIM product mapping, monthly token quotas, budget filters, token rates, reconciliation cadence, and restore reference.
- The deployment operator has time-bound access to assign policy, deploy subscription budgets, and preview subscription-scope Bicep.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Deployment | artifacts/policy/tag-allocation.bicep | The subscription policy deployment pipeline |
| Deployment | artifacts/policy/tag-allocation.bicepparam | The subscription policy deployment pipeline |
| Deployment | artifacts/cost/ai-budget-with-filters.bicep | The subscription budget deployment pipeline and cost owner |
| Deployment | artifacts/cost/ai-budget-with-filters.bicepparam | The subscription budget deployment pipeline |
| Runtime | artifacts/apim/token-chargeback-policy.xml | The API Management gateway policy repository |
| Runtime | artifacts/queries/token-chargeback.kql | The FinOps analyst and Application Insights or Log Analytics operator |
| Record | artifacts/finance/chargeback-decisions.json | The cost owner, gateway owner, and module preflight scripts |
| Record | artifacts/finance/token-rate-table.json | The FinOps analyst and chargeback reporting pipeline |
Resolve every __REQUIRED_*__ value in the approved private implementation path before deployment. Keep subscription IDs, resource IDs, tenant IDs, prompts, responses, tokens, customer names, and raw usage exports out of this repository.