Azure Centric
EN PT
Automação e IaC 6 min de leitura

Plan ownership and deletion behaviour for an infrastructure stack

MN
Marcos Nogueira Também disponível em English →

Este artigo ainda não foi traduzido — está a ver a versão em inglês.

Nesta página
  1. Planning the ownership model
  2. Controlling detachment and deletion
  3. Updating and deleting stacks
  4. Known limitations and issues
  5. Verification
  6. Cleanup

An Azure deployment stack is a resource that manages a group of Azure resources as a single unit. It lets you define what resources the stack manages, and what happens to them when they are removed from the template or when the stack itself is deleted. The key decision is whether unmanaged resources should be detached or deleted, and who has permission to make that choice.

The stack transpiles Bicep files into ARM JSON templates and deploys them as a deployment object. It offers additional capabilities beyond familiar deployment resources, such as preventing undesired modifications via deny settings and efficient environment cleanup using delete flags during stack updates Create and deploy Azure deployment stacks in Bicep.

Planning the ownership model

A deployment stack can be created at resource group, subscription, or management group scope. The scope you choose determines where the stack resource lives and where it can deploy resources.

It is important to note that where a deployment stack exists, so is the deny-assignment created with the deny settings capability. For example, by creating a deployment stack at subscription scope that deploys the template to resource group scope and with deny settings mode DenyDelete, you can easily provision managed resources to the specified resource group and block delete attempts to those resources. This approach helps to enhance the security of the deployment stack by separating it at the subscription level instead of at the resource-group level. This separation ensures that the developer teams working with the provisioned resources only have visibility and write access to the resource groups. The deployment stack remains isolated at a higher level. This configuration minimises the number of users that can edit a deployment stack and make changes to its deny-assignment Create and deploy Azure deployment stacks in Bicep.

There are two built-in roles for deployment stacks:

Controlling detachment and deletion

A detached resource (or unmanaged resource) refers to a resource that the deployment stack doesn’t track or manage but still exists within Azure. To instruct Azure to delete unmanaged resources, update the stack with the create stack command and include the ActionOnUnmanage switch Create and deploy Azure deployment stacks in Bicep.

Allowed values for ActionOnUnmanage are:

For example, to create a subscription-scoped stack that deletes managed resources and resource groups:

New-AzSubscriptionDeploymentStack `
  -Name "<deployment-stack-name>" `
  -TemplateFile "<bicep-file-name>" `
  -DenySettingsMode "none" `
  -ActionOnUnmanage "deleteAll"

When deleting resource groups with the action-on-unmanage switch set to deleteAll, you delete the managed resource groups and all the resources contained within them Create and deploy Azure deployment stacks in Bicep.

Updating and deleting stacks

To update a deployment stack, which might involve adding or deleting a managed resource, you need to make changes to the underlying Bicep files. Once you make the modifications, you can update the deployment stack by either running the update command or rerunning the create command Create and deploy Azure deployment stacks in Bicep.

To update a deployment stack at the resource group scope:

Set-AzResourceGroupDeploymentStack `
  -Name "<deployment-stack-name>" `
  -ResourceGroupName "<resource-group-name>" `
  -TemplateFile "<bicep-file-name>" `
  -ActionOnUnmanage "detachAll" `
  -DenySettingsMode "none"

The Azure CLI doesn’t have a deployment stack set command. Use the New command instead Create and deploy Azure deployment stacks in Bicep.

To delete the deployment stack, and the managed resources:

az stack group delete \
  --name 'demoStack' \
  --resource-group 'demoRg' \
  --action-on-unmanage 'deleteAll'

To delete the deployment stack, but detach the managed resources:

az stack group delete \
  --name 'demoStack' \
  --resource-group 'demoRg' \
  --action-on-unmanage 'detachAll'

The remove command only removes the managed resources and managed resource groups. You still need to delete the resource group Create and deploy a deployment stack with Bicep from template specs.

Known limitations and issues

There are several known limitations and issues to be aware of:

Verification

To verify the deployment, you can list the deployed deployment stacks at the subscription level:

az stack group show \
  --resource-group 'demoRg' \
  --name 'demoStack'

The output shows two managed resources - one storage account and one virtual network Create and deploy a deployment stack with Bicep from template specs.

You can also verify the deployment by list the managed resources in the deployment stack:

az stack group show \
  --name 'demoStack' \
  --resource-group 'demoRg' \
  --output 'json'

The output is similar to Create and deploy a deployment stack with Bicep from template specs:

{
  "actionOnUnmanage": {
    "managementGroups": "detach",
    "resourceGroups": "detach",
    "resources": "detach"
  },
  ...
  "resources": [
    {
      "denyStatus": "none",
      "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk",
      "resourceGroup": "demoRg",
      "status": "managed"
    },
    ...
  ]
}

Cleanup

az group delete \
  --name 'demoRg'

To delete the template spec and the resource group:

az group delete \
  --name 'templateSpecRG'

}

Pesquisar