Stop someone deleting prod: resource locks in one line

Every ops team has the story: someone runs az group delete against the wrong resource group, and production is gone. A resource lock is the cheapest insurance in Azure against that, and it's a single command.

Lock a resource group so nobody can delete anything in it:

az lock create --name no-delete --lock-type CanNotDelete --resource-group prod-rg

That's it. CanNotDelete still lets people read and change resources, it just refuses deletion until someone removes the lock. To freeze something completely, with no changes at all, use ReadOnly instead. A lock applies to everything inside its scope, so one on the resource group protects every resource in it.

That inheritance is the part worth understanding, because it decides where you put the lock:

management group
└─ subscription
   └─ prod-rg              <- lock applied here
      ├─ app-service          inherited: CanNotDelete
      ├─ sql-server           inherited: CanNotDelete
      └─ storage-account      inherited: CanNotDelete

One lock, at the scope above the things you care about. Put it on the resource group and it covers every resource inside, including ones created later.

To make it repeatable rather than a one-off click, the same thing in Terraform:

data "azurerm_resource_group" "prod" {
  name = "prod-rg"
}

resource "azurerm_management_lock" "no_delete" {
  name       = "no-delete"
  scope      = data.azurerm_resource_group.prod.id
  lock_level = "CanNotDelete"
  notes      = "Protects production from accidental deletion."
}

This is the reliability pillar of WAF in its simplest form: make the destructive action take a deliberate second step instead of a single wrong command.

At scale, locks get applied automatically across a management-group hierarchy so no critical scope is ever left unprotected. For now, one lock on the resource group you'd hate to lose is five minutes well spent.

The full, runnable version is in the blog-examples repo.

Next: pinning Azure to the regions you allow.