Implementation | Session 03: Model governance, data residency, quota, and lifecycle

Chapter 5 of 6

Implement#

1. Complete the inputs#

Add every approved deployment to artifacts/models/deployment-profiles.json. Set the existing Foundry resource name in artifacts/environments/sandbox.bicepparam.

2. Run preflight#

Set the approved scope and operator identity:

PowerShell

$approvedSubscriptionId = $env:AZURE_SUBSCRIPTION_ID
$resourceGroup = "approved-session-03-resource-group"
$foundryAccount = "approved-existing-foundry-resource"
$operatorObjectId = "00000000-0000-0000-0000-000000000000"
.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ResourceGroupName $resourceGroup `
  -FoundryAccountName $foundryAccount `
  -OperatorObjectId $operatorObjectId

Bash

approved_subscription_id="${AZURE_SUBSCRIPTION_ID:-}"
resource_group="approved-session-03-resource-group"
foundry_account="approved-existing-foundry-resource"
operator_object_id="00000000-0000-0000-0000-000000000000"
./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --resource-group-name "$resource_group" \
  --foundry-account-name "$foundry_account" \
  --operator-object-id "$operator_object_id"

Add a manual-confirmation switch only after completing the check named by preflight. Inspect the FullResourcePayloads preview. It may contain Create, Modify, or NoChange for listed child deployments and nothing else.

3. Deploy#

PowerShell

az deployment group create `
  --resource-group $resourceGroup `
  --name rvas-s04-approved-models `
  --template-file .\artifacts\infra\models\main.bicep `
  --parameters .\artifacts\environments\sandbox.bicepparam `
  --only-show-errors

Bash

az deployment group create \
  --resource-group "$resource_group" \
  --name rvas-s04-approved-models \
  --template-file ./artifacts/infra/models/main.bicep \
  --parameters ./artifacts/environments/sandbox.bicepparam \
  --only-show-errors

4. Assign model-deployment policy#

Resolve the two built-in definition IDs, complete artifacts/model-approval-register.json, then run the policy preflight:

PowerShell

$env:RVAS_APPROVED_MODELS_POLICY_ID = az policy definition list --query "[?displayName=='Foundry model deployments should only use approved models'].id | [0]" --output tsv
$env:RVAS_MODEL_ELIGIBILITY_POLICY_ID = az policy definition list --query "[?displayName=='Foundry model deployments should meet eligibility requirements'].id | [0]" --output tsv
.\scripts\preflight-model-policy.ps1 -TargetScope "approved-model-policy-scope" -ResourceGroup $resourceGroup
az deployment group create --resource-group $resourceGroup --template-file .\artifacts\policy\model-governance.bicep --parameters .\artifacts\policy\model-governance.bicepparam --only-show-errors

Bash

export RVAS_APPROVED_MODELS_POLICY_ID="$(az policy definition list --query "[?displayName=='Foundry model deployments should only use approved models'].id | [0]" --output tsv)"
export RVAS_MODEL_ELIGIBILITY_POLICY_ID="$(az policy definition list --query "[?displayName=='Foundry model deployments should meet eligibility requirements'].id | [0]" --output tsv)"
./scripts/preflight-model-policy.sh --target-scope "approved-model-policy-scope" --resource-group "$resource_group"
az deployment group create --resource-group "$resource_group" --template-file ./artifacts/policy/model-governance.bicep --parameters ./artifacts/policy/model-governance.bicepparam --only-show-errors