Ensure that Azure Resource Group has resource lock enabled

[krowlandson]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Is your feature request related to a problem?

As identified during the work in issue #268, terrascan recommends that all Resource Groups have resource lock enabled.

The following provides a summary of the errors created by this missing feature:

        -----------------------------------------------------------------------
    Description    :        Ensure that Azure Resource Group has resource lock enabled
    File           :        resources.connectivity.tf
    Module Name    :        root
    Line           :        1
    Severity       :        LOW

    -----------------------------------------------------------------------

    Description    :        Ensure that Azure Resource Group has resource lock enabled
    File           :        resources.management.tf
    Module Name    :        root
    Line           :        1
    Severity       :        LOW

    -----------------------------------------------------------------------

    Description    :        Ensure that Azure Resource Group has resource lock enabled
    File           :        resources.virtual_wan.tf
    Module Name    :        root
    Line           :        1
    Severity       :        LOW

    -----------------------------------------------------------------------

As a temporary workaround, we are implementing an override to disable this rule in terrascan.

Describe the solution you'd like

This issue is being raised to track addition of this feature to the module.

We are not remediating this as part of #268 as it falls out of scope for this issue. This would also require a minor release due to the addition of new resources.

Additional context

[jtracey93]

@krowlandson do we think this a good idea? We should also do in all implementations if so, right?

I personally don't think we should do this. And if we do, it should be CannotDelete only not ReadOnly 👍

[jtracey93]

Trigger ADO Sync

[krowlandson]

Trigger ADO Sync

[matt-FFFFFF]

AB#25457

[qaiserali]

I think this is a good idea to set a lock on a resource group level. But I also agree with @jtracey93 that the lock should be set to CannotDelete instead of ReadOnly.

[matt-FFFFFF]

Thanks @qaiserali

Locks with Terraform form part of the resource graph, therefore they do not prevent accidental deletion with Terraform, only with other ARM clients.

This is the reason that we have not prioritized this