Stop someone deleting prod: resource locks in one line

Every ops team has the story: someone runs az group delete against the wrong resource group, and production is gone. A resource lock is the cheapest insurance in Azure against that, and it's a single command.

Lock a resource group so nothing in it can be deleted:

az lock create --name no-delete --lock-type CanNotDelete --resource-group prod-rg

That's it. CanNotDelete still lets people read and change resources, it just refuses deletion until the lock is removed. To freeze something completely, with no changes at all, use ReadOnly instead. A lock applies to everything inside its scope, so one on the resource group protects every resource in it.

To make it repeatable rather than a one-off click, the same thing in Terraform:

data "azurerm_resource_group" "prod" {
  name = "prod-rg"
}

resource "azurerm_management_lock" "no_delete" {
  name       = "no-delete"
  scope      = data.azurerm_resource_group.prod.id
  lock_level = "CanNotDelete"
  notes      = "Protects production from accidental deletion."
}

This is the reliability pillar of WAF in its simplest form: make the destructive action take a deliberate second step instead of a single wrong command.

At scale, locks get applied automatically across a management-group hierarchy so no critical scope is ever left unprotected. For now, one lock on the resource group you'd hate to lose is five minutes well spent.

Next: pinning Azure to the regions you allow.