Protecting Azure Resources with Resource Manager Locks

Azure, ARM, Azure-Resource-Manager

Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion or changing of a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and when applied will place the restriction on the resource for all users. These are very useful when you have an important resource in your subscription which users should not be able to delete or change and can help prevent accidental and malicious changes or deletion.

There are two types of resource locks that can be applied:

  1. CanNotDelete – This prevents anyone from deleting a resource whilst the lock is in place, however they may make changes to it.
  2. ReadOnly – As the name suggests, it makes the resource read only, so no changes can be made and it cannot be deleted.

Resource locks can be applied to subscriptions, resource groups or individual resources as required. When you lock Subscription, all resources in that subscription (including ones added later) inherit the same lock. Once applied, these locks impact all users regardless of their roles, if it becomes necessary to delete or change a resource with a lock in place then the lock will need to be removed before this can occur.

Permissions

Permission to set and remove locks requires access to one of the following RBAC permissions:

– Microsoft.Authorization/*
– Microsoft.Authorization/locks/*

By default, these actions are only available on the Owner and User Access Administrator built in RBAC Roles, however you can add them to custom roles as required. As mentioned, users with these roles are still subject to the locks, but obviously they can remove them if required. Creation and deletion of a lock is tracked in the Azure Activity log.

Users who attempt to delete or change a resource with a lock in place will receive this error:

Failed to delete storage account 'criticalstorageaccount1'. 
Error: The scope '/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/lambdatoys/providers/Microsoft.Storage/storageAccounts/criticalstorageaccount1' cannot perform delete operation because following scope(s) are locked: '/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/LambdaToys/providers/Microsoft.Storage/storageAccounts/criticalstorageaccount1'. 
Please remove the lock and try again.

Creating Locks

Locks can be created both at the time of creation of a resource inside an ARM template, or later using the portal or PowerShell.

Creating Locks At Resource Creation

The best way to ensure that locks are in place and protecting your resources is to create them at run time and configure them in your ARM templates. Locks are top level ARM resources, they do not sit underneath the resource being locked. They refer to the resource being locked, so this must exist first. In the example below we are creating a storage account, and then adding a lock to prevent it being deleted. The “type” provided will be specific to the resource type your are attempting to lock.

"resources": [
    {
        "type": "Microsoft.Storage/storageAccounts",
        "name": "criticalstorageaccount1",
        "apiVersion": "2015-06-15",
        "location": "[resourceGroup().location]",
        "tags": {
            "displayName": "criticalstorageaccount1"
        },
        "properties": {
            "accountType": "Standard_LRS"
        }
    },
    {
        "name": "[concat('criticalstorageaccount1', '/Microsoft.Authorization/criticalStorageLock')]",
        "type": "Microsoft.Storage/storageAccounts/providers/locks",
        "apiVersion": "2015-01-01",
        "properties": {
            "level": "CannotDelete"
        }
    }
]

 

The “level” setting can be changed to “ReadOnly” as required.

Adding Locks

Locks can be added to existing resources either through the portal or using PowerShell.

Portal

  1. Locate the resource you wish to lock and select it. In the main blade, click the “Locks” icon

  1. Click Add
  2. Give the lock a name and description, then select the type, deletion or read only.

  1. Click OK to save the lock, the resource is now protected.
  2. To remove the lock, simply come back to teh same interface, select the lock and then go to delete

PowerShell

The following PowerShell can be used to add a lock to an existing resource. Again, the ResourceType will vary depending on the resource you are trying to lock.

New-AzureRmResourceLock -LockLevel CanNotDelete -LockName criticalStorageLock -ResourceName criticalstorageaccount1 -ResourceType Microsoft.Storage/storageAccounts -ResourceGroupName CriticalStorageRG

 

To remove a lock use the Remove-AzureRmResourceLock.

Remove-AzureRmResourceLock -LockName criticalStorageLock -ResourceName criticalstorageaccount1 -ResourceGroupName CriticalStorageRG -ResourceType Microsoft.Storage/storageAccounts

 

Summary

By using Resource Logs you can put in place an extra line of defense against accidental or malicious changing and/or deletion of your most important resources. It’s not perfect, as your administrators can still remove these locks, but doing so requires a conscious effort, as the only purpose for removing a lock is to circumvent it. As these locks sit outside of RBAC you can apply them and be sure that they are impacting all your users, regardless of what roles or custom permissions you may have granted them.