Azure Resource Lock – Simple 2 Steps
Tags: azure, management, security, cloudskills
Published: 2020-11-21 10:34:19

<h1>What is Resource Lock?</h1>

The <b>Resource Lock in Azure</b> is Super powerful <b>Resource Manager</b> that provides Azure Admins a way to lock-down required Azure Resources and prevent them from accidental deletions and modifying of the resources. It is powerful than Role Based Access Control (RBAC), puts restrictions on the azure resources that is applicable for all type of users.

<h2>Another way to easily remember</h2>

Admin – <i>“We have all access“</i>

Developers – <i>“We have some access“</i>

Read users – <i>“We have read alone access“</i>

RESOURCE LOCK be like – <i>“Whoever you are (Admin, Developers, Read Users), you all are same to me, Face me first (Edit/Delete), Go to the Resources then!“</i>

<h2>How to implement this? Answer is very Simple, Check the below steps with pics!</h2>

<h3><b>STEP 1 – Sample Resource</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wwvnv62sqiaybx20k87z.png)

Sample here shown is Storage Account. Mostly, all the azure resources that supports Resource Locks.

Resource Level is granularity, if we planning to go at Resources level, it’s fine but may be time consuming. We can put resource locks at Resource Group level too. (Even Subscription also supports Resource Locks, but it is up to us and our purpose of doing so)

<h3><b>STEP 2 – Locks Blade/Option in each Azure Resource’s Left side menu list</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/oi1esk5xo6umpsw8r93r.png)

All Azure Resources/ Resource groups/ even Subscriptions have RESOURCE LOCK Option (Locks Blade).

<h3><b>STEP 3 – Click + Add in Locks blade, to add Resource Locks</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zqjn7ik0qt70bsu183ra.png)

<h3><b>STEP 4 – Provide Lock Name & Notes of Lock and Understand Choosing Lock Types</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/hjbx0984inukh2l0hnyj.png)

<b><u>Lock Types</u></b> – <b>1.</b> Delete <b>2.</b> Read-alone

<b>1.Delete Lock</b> Type – This type of resource lock prevents resources from deleting, but it will not stop updating/making changes of the resources.

<b>2.Read-alone Lock</b> Type – This type of resource lock prevents resources from deleting/updating/making changes. Read alone it will permits. Even API calling sometimes it thinks it may be update and it would throw error. (so, it is risky to use in hot access things, for cold access things, its recommendable like archives)

Choosing Lock Types is up to us and as per our use case. DELETE as RESOURCE LOCK is recommendable to prevent accidental deletes!

<h3><b>STEP 5 – Edit or Delete Locks to change Lock Types and Notes</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/35jgl4ntcev7cx1cmd9i.png)

Azure Admins can change Lock types and notes in Locks by clicking <b>Edit</b> icon and can click <b>Delete</b> to remove locks!

<b><i>By default, none of the resources have any Resource Locks.</i></b>

<h3><b>STEP 6 – What happens if anyone deletes resources when Resource Lock is there?</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/u8ybvn8fqn6uvfcoi1gp.png)

<h3><b>STEP 7 – Resources won’t get deleted by anyone (even admin can’t do) unless Resource Lock gets Edited or Deleted</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wyafnfu5q875umn7vuy7.png)

<h3><b>STEP 8 – If Non-Admins tried…</b></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ie2ng9c6rz0836eyj7nq.png)

<h2>Summary</h2>

<b>Steps 1, 2</b> – To Understand regarding Resource Locks, how it sits outside and different from RBAC, and Sample Resources.

<b>Steps 3, 4</b> – <b><i>Actual 2 steps to put Resource Locks!</i></b>

<b>Step 5</b> – To Edit or Delete Resource Locks!

<b>Steps 6, 7, 8</b> – what will happen if we delete the resource that is having Resource Locks, and how it looks like if we don’t have access and try Resource Lock!