Lab — Tags do not inherit, and a lock is not a permission
AZ-104 › Unit 1 › Lab
Lab — Tags do not inherit, and a lock is not a permission
Lab brief
- AZ104-U1.T3
- 25 minutes
- A resource group, a tag, a policy assignment, a lock
- required
- Core
Two claims in one sitting: resources do not inherit a resource group's tags, and a lock stops a delete even when your role permits it. Both are one command away from being obvious.
Before you start
A subscription and the ability to create policy assignments and locks on it. Everything created here is a governance object or an empty resource group; none of it is billable.
Walkthrough
Tags do not inherit, and a lock is not a permission
1. Create a tagged resource group
az group create --name bb-lab-gov --location westeurope --tags costCenter=1234. The tag is on the group.
Did it teach you what it was meant to?
Step 2 showed an untagged resource inside a tagged resource group. What does that rule out as a design?
In step 5 the delete was refused although your role allows it. Which statement does that experiment support?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Remove the lock first, then the assignment, then the group
The order matters and it is the lab's last lesson: az lock delete for the lock, az policy assignment delete --name --scope $rgid for the assignment, then az group delete --name bb-lab-gov. With the lock still in place, the group delete is refused.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Manage Azure resource groups by using Azure CLI | a3840d837a3d |
| Use tags to organize your Azure resources | b1d92e330865 |
| Create a policy assignment with Azure CLI | 9adc3ee57e46 |
| What is Azure Policy? | 0bc00fcd34d3 |
| Lock your Azure resources | 0a4f4f548288 |