6

As we know that we can apply a lock to prevent the accidental deletion of a VM in azure. To delete it - we have to un-assign/delete the lock first. But Why azure provides multiple delete locks on the same resource? even a single lock will work as same as multiple locks.

Below is an example image - enter image description here

Indrajeet Singh
  • 470
  • 1
  • 6
  • 21

3 Answers3

8

I tried this to seek an answer.

Entity A puts a Delete lock for a reason. Entity B puts a (second) Delete lock for another reason.

After a while, when Entity A is happy that he/she no longer needs the lock, he/she will remove it. However, Entity B still has a reason to keep the resource locked from being deleted.

Tried this today. Thanks for bringing up this scenario. Hope the answer helps.

Naveed Sait
  • 96
  • 1
  • 2
1

You can set the lock level to CanNotDelete or ReadOnly. For your question that why Azure provides multiple delete locks on the same resource. I think the main reason is that you could directly set a lock on a subscription, resource group, or resource level in a resource UI instead of going back to set the lock in each resource UI.

For example, you can set a resource group level Delete lock by selecting resource group on virtual machine locks UI, all resources within that resource group inherit the same lock.

enter image description here

When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the lock from the parent. The most restrictive lock in the inheritance takes precedence.

Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Nancy
  • 26,865
  • 3
  • 18
  • 34
  • 1
    I got your point.For resource groups or subscription level, it is fine but if we talk about a single resource (i.e. Storage Account). We have the option to add multiple delete locks on the resource level, what is the purpose of having that? (I have added a image on the question recently). – Indrajeet Singh Dec 24 '20 at 11:29
  • 1
    I don't think there is a specific purpose just Azure design for it, aha. I think if you create multiple delete type Lock on a single resource, it does work as one delete type Lock on a single resource, the difference is that the Former push you delete the Lock multiple times before you want to really delete it because there are multiple duplicate Locks locking on that resources. – Nancy Dec 25 '20 at 02:10
  • Do you still expect a better answer? – Nancy Dec 30 '20 at 07:18
  • 1
    Yeah I there should be a better reason for it, just looking for it otherwise I'll accept your answer. – Indrajeet Singh Dec 30 '20 at 07:34
1

Probably some resource will need a 'Delete' acceptance from different Admin groups, hence the multiple locks?

If it's a critical resource, the the first lock can be a general, inherited one and the second lock can be from a higher admin group.

Vinod Nair
  • 11
  • 1