Locks on Subscription or ResourceGroup

[JonasCordsen]

Hello

We are working on the possibility to ensure that locks are applied.

I can see that you already have a todo on locks, so maybe this will "resolve" itself

For now I am trying to create a custom rule for it, but how to I create a rule that ensure that IE. a ressourcegroup has the lock, since the lock is not really a setting of the Resource it self.

Is this anything you have an idea of?

[BernieWhite]

@JonasCordsen Thanks for the question. Is your use case for pre-flight testing with Infrastructure as Code or in-flight testing? See https://azure.github.io/PSRule.Rules.Azure/faq/#whatmethodsaresupportedforcheckingresources for the differences.

[JonasCordsen]

@BernieWhite

It is in-flight(so post deployment test), we want to make sure that locks are active on the subscription or ressource groups

[BernieWhite]

@JonasCordsen For in-flight testing, we export Microsoft.Authorization/locks as a nested resource for resource groups. So resource group will have a resources property that looks like this:

{
    "ResourceGroupName": "rg-test",
    "Location": "region",
    "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-test",
    "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-test",
    "ResourceType": "Microsoft.Resources/resourceGroups",
    "Name": "rg-test",
    "resources": [
        {
            "Name": "resource",
            "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-test/providers/microsoft.insights/components/appi-test/providers/Microsoft.Authorization/locks/resource",
            "ResourceName": "appi-test",
            "ExtensionResourceName": "resource",
            "ExtensionResourceType": "Microsoft.Authorization/locks",
            "ResourceGroupName": "rg-test",
            "SubscriptionId": "00000000-0000-0000-0000-000000000000",
            "Properties": {
                "level": "CanNotDelete",
                "notes": "Prevent deletion of resource data"
            },
            "LockId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-test/providers/microsoft.insights/components/appi-test/providers/Microsoft.Authorization/locks/resource",
            "ResourceType": "Microsoft.Authorization/locks"
        }
    ]
}

So a rule to check for resource locks would need to find any Microsoft.Authorization/locks instances under the resources property of the RG.

The above example is for a lock on an Application Insights resources within the RG which is included but since you only want to know if the lock applied to the whole RG you would need to only consider sub-resources based on a property such as resourceId.

# Synopsis: Require locks on RGs.
Rule 'Local.ResourceGroup.Locked' -Type 'Microsoft.Resources/resourceGroups' {
    $locks = @($PSRule.GetPath($TargetObject, 'resources[[email protected] == ''Microsoft.Authorization/locks'']') | Where-Object {
        $_.ResourceId -like "*/resourceGroups/$($_.ResourceGroupName)/providers/Microsoft.Authorization/locks/*"
    })
    $Assert.GreaterOrEqual($locks, '.', 1).ReasonFrom('resources', 'Resource group is not locked.')
}

With custom rules you may need to configure binding options to within ps-rule.yaml such as:

# Configure binding options
binding:
  targetType:
  - 'resourceType'
  - 'type'
  targetName:
  - 'resourceName'
  - 'name'

See https://azure.github.io/PSRule.Rules.Azure/customization/enforce-custom-tags/#bindingtype for more details.

[BernieWhite]

@JonasCordsen Did this help?

[JonasCordsen]

@BernieWhite
Yes it! Very cool, thanks :D