Hello everyone, in the last post we explained how to create and remove resource groups using PowerShell and the Azure CLI. If you haven’t read it yet, check out this link.
In this post, we’ll explain how to use Azure resource lock to protect resources and resource groups in Azure from accidental removal in Azure.
What is Resource Lock?
Azure Resource Lock is designed to protect resource groups and resources from accidental removal, blocking changes in two ways: “CanNotDelete” and “ReadOnly“.
Creating a Lock on a resource group in the Azure Portal
Below, we’ll show how to create a lock on a resource group using the Azure portal:
In the Azure portal, access the Resource groups menu.
Click the Resource group and navigate the menu on the left until you find the Locks button.
Click the Add button to add a lock to the selected resource group.
To illustrate, I’m creating a Read-Only type Lock named “Rg-ReadOnly”.
Now let’s try to delete the resource group “rsg-lab-rgl” that we just protected with the Lock.
Click “Overview” and “Delete resource group“.
When you try to delete a resource group that’s protected by a lock, a message is displayed informing you of the protection, and clicking the message redirects you to the lock that’s protecting that resource from removal.
Removing a lock using the portal
To unblock removal of a resource or resource group using the portal, select the resource for which you want to remove the protection, click the menu to the right of the lock, and then Delete.
After removing the lock from the resource group, it will be possible to remove the item that was previously protected.
Creating locks through PowerShell
Now let’s create a resource group lock using PowerShell. With the command below, I’m creating a lock named Lock-ps for the resource group rg-lab-locks with a brief description of the reason for the protection in the notes field (optional).
Note: If you don’t have the Azure module for PowerShell yet, check out this link where I explain how to install the Azure module in PowerShell and connect to Azure.
Open PowerShell, connect to Azure, and run the command below:
New-AzResourceLock -LockLevel CanNotDelete -LockNotes "Lock pelo powershell" -LockName "Lock-ps" -ResourceGroupName "rg-lab-locks"
Syntax: New-AzResourceLock -LockLevel “CanNotDelete or ReadOnly” -LockNotes “description note” -LockName “lock name” -ResourceGroupName “resource group name”
Let’s create a lock on the storage resource I provisioned to illustrate this activity. I’ll run the command below to create a lock that blocks deletion of this resource:
New-AzResourceLock -LockLevel CanNotDelete -LockNotes "lock de recurso em ps" -LockName "storslock" -ResourceName "stolablock" -ResourceType "Microsoft.Storage/storageAccounts" -ResourceGroupName "rg-lab-locks"
Syntax: New-AzResourceLock -LockLevel “CanNotDelete or ReadOnly” -LockNotes “description note” -LockName “lock name” -ResourceName “resource name”
When I try to remove the storage resource that was created, I receive a message that it’s not possible to remove it because there’s a lock protecting that resource from removal.
For more information about resource lock command options in Azure, check out this link.
Identifying existing locks
To identify the existing locks in the subscription, run the command “get-azresourcelock”.
Removing locks using PowerShell
To remove a lock using PowerShell, we’ll collect the Lockid and store it in a variable called $lockid, using the command below:
$lockid = (Get-AzResourceLock -ResourceGroupName rg-lab-locks).Lockid
To remove the lock using the variable, run the command below:
Remove-AzResourceLock -Lockid $lockid
Summary
Today we covered Azure resource lock, which makes it possible to protect resources and resource groups from improper removal or modification.
In the next post, we’ll talk about resource access control using Access Control (IAM), which lets the administrator control access to resources in Azure.
Did you like the post? Like and share it.
If you have any suggestions or comments, let us know.
[ ]’s
Ulysses Neves
