Adding resource locks to terraform

frasermolyneux · Dec 9, 2023 · 4ec9b09 · 4ec9b09
1 parent e81fc68
commit 4ec9b09
Show file tree

Hide file tree

Showing 5 changed files with 35 additions and 0 deletions.
diff --git a/terraform/app_data_storage.tf b/terraform/app_data_storage.tf
@@ -14,6 +14,13 @@ resource "azurerm_storage_account" "app_data_storage" {
   tags = var.tags
 }
 
+resource "azurerm_management_lock" "app_data_storage_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_storage_account.app_data_storage.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}
+
 resource "azurerm_storage_container" "map_images_container" {
   name = "map-images"
 

diff --git a/terraform/common.tf b/terraform/common.tf
@@ -4,3 +4,10 @@ resource "azurerm_resource_group" "rg" {
 
   tags = var.tags
 }
+
+resource "azurerm_management_lock" "rg_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_resource_group.rg.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}
diff --git a/terraform/key_vault.tf b/terraform/key_vault.tf
@@ -18,6 +18,13 @@ resource "azurerm_key_vault" "kv" {
   }
 }
 
+resource "azurerm_management_lock" "kv_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_key_vault.kv.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}
+
 resource "azurerm_role_assignment" "apim_kv_role_assignment" {
   scope                = azurerm_key_vault.kv.id
   role_definition_name = "Key Vault Secrets User"

diff --git a/terraform/main.tf b/terraform/main.tf
@@ -73,3 +73,10 @@ resource "random_id" "environment_id" {
 resource "time_rotating" "thirty_days" {
   rotation_days = 30
 }
+
+resource "random_id" "lock" {
+  keepers = {
+    id = "${timestamp()}"
+  }
+  byte_length = 8
+}
diff --git a/terraform/sql_database.tf b/terraform/sql_database.tf
@@ -8,3 +8,10 @@ resource "azurerm_mssql_database" "repo" {
 
   max_size_gb = 2
 }
+
+resource "azurerm_management_lock" "repo_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_mssql_database.repo.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}