Resource lock should use CanNotDelete or ReadOnly level

Medium Azure General locks-resource-lock-cannotdelete-readonly

Applies to

Microsoft.Authorization/locks

What CGPulse checks

A resource passes this rule when level must be one of ["CanNotDelete","ReadOnly"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set lock level to CanNotDelete or ReadOnly to protect critical resources from accidental changes. In Azure Portal: Resource > Locks > set lock level. See: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

CLI

az lock create --name "{name}" --resource-group "{rg}" --lock-type CanNotDelete --notes "Prevent accidental deletion"

Bicep

resource lock 'Microsoft.Authorization/locks@2020-05-01' = {
  name: '{name}'
  properties: {
    level: 'CanNotDelete'
    notes: 'Prevent accidental deletion of critical resources'
  }
}

Terraform

resource "azurerm_management_lock" "{name}" {
  name       = "{name}"
  scope      = "<resource-id>"
  lock_level = "CanNotDelete"
  notes      = "Prevent accidental deletion of critical resources"
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan