【Bicep】3年半越しのGA！Azure Deployment stacksのwhat-ifで本番事故を防ぐ7つの検証パターン

/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Resources/deploymentStacksWhatIfResults/{what-if-result-name}

Copy

param location string = resourceGroup().location
param storageSku string
param includeNsgA bool
param saTagEnv string

resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'stwhatif${uniqueString(resourceGroup().id)}'
  location: location
  sku: { name: storageSku }
  kind: 'StorageV2'
  tags: { env: saTagEnv }
}

resource nsgA 'Microsoft.Network/networkSecurityGroups@2023-11-01' = if (includeNsgA) {
  name: 'nsg-whatif-a'
  location: location
  properties: {
    securityRules: [
      {
        name: 'allow-https'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourceAddressPrefix: ''
          sourcePortRange: ''
          destinationAddressPrefix: '*'
          destinationPortRange: '443'
        }
      }
    ]
  }
}

Copy

using './main.bicep'

param storageSku = 'Standard_LRS'
param includeNsgA = false
param saTagEnv = 'demo'

Copy

az cli version: 2.89.1
az bicep version: 0.46.1

Copy

az stack-whatif group create \
  --name <what-if-result-name> \
  --resource-group <resource-group-name> \
  --stack-id <deployment-stack-resource-id> \
  --template-file main.bicep \
  --action-on-unmanage deleteAll \
  --deny-settings-mode none \
  --retention-interval PT3H

Copy

#環境変数
RG=<resource-group-name>
LOCATION=japaneast

#リソースグループ作成
az group create --name $RG --location $LOCATION

Copy

#環境変数
SUB_ID=<subscription-id>
RG=<resource-group-name>
STACK_NAME=stack-test
STACK_ID=/subscriptions/$SUB_ID/resourceGroups/$RG/providers/Microsoft.Resources/deploymentStacks/$STACK_NAME
STACK_WIF_NAME="${STACK_NAME}-wif-result"

#スタック作成の差分確認
az stack-whatif group create 
  --name $STACK_WIF_NAME 
  --resource-group $RG 
  --stack-id $STACK_ID 
  --action-on-unmanage deleteAll 
  --deny-settings-mode none 
  --retention-interval PT3H 
  --parameters main.bicepparam

Copy

Resource and property changes are indicated with these symbols:
  + Create              ! Unsupported
  ~ Modify              - Delete
  = NoChange            v Detach

Changes to Stack /subscriptions//resourceGroups//providers/Microsoft.Resources/deploymentStacks/stack-
test:
+ DenySettings.Mode: "None"
+ DenySettings.ApplyToChildScopes: "False"

Changes to Managed Resources:

Azure
  + /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    ~ Management Status: "notManaged" => "managed"
    = Deny Status: "none"

Copy

az stack group create \
  --name $STACK_NAME \
  --resource-group $RG \
  --deny-settings-mode none \
  --action-on-unmanage deleteAll \
  --parameters main.bicepparam

Copy

param includeNsgA = true

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-nsga" \
  ...

Copy

Azure
  + /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    ~ Management Status: "notManaged" => "managed"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"

Copy

param storageSku = 'Standard_GRS'
param saTagEnv = 'test'

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-st-grs" \
  ...

Copy

Azure
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
  ~ /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"
    ~ sku.name: "Standard_LRS" => "Standard_GRS"
    ~ tags.env: "demo" => "test"

Copy

az network nsg create -g $RG -n nsg-whatif-b --location japaneast

Copy

resource nsgB 'Microsoft.Network/networkSecurityGroups@2023-11-01' = {
  name: 'nsg-whatif-b'
  location: location
}

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-nsgb" \
  ...

Copy

Azure
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-b [2023-11-01]
    ~ Management Status: "notManaged" => "managed"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"

Copy

param includeNsgA = false

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-check-action" \
  ...
  --action-on-unmanage <適宜変更> \
  ...

Copy

Azure
  v /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a
    ~ Management Status: "managed" => "notManaged"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-b [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"

Copy

Azure
  - /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a
    ~ Management Status: "managed" => "notManaged"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-b [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"

Deleting - Resources Marked for Deletion 1 total:

Azure
  - /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-check-drift" \
  ...

Copy

Azure
  ~ /subscriptions//resourceGroups//providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
    ~ properties.securityRules:
      - 1:
          {
            "name": "allow-ssh",
            "properties": {
              "access": "Allow",
              "destinationAddressPrefix": "",
              "destinationPortRange": "22",
              "direction": "Inbound",
              "priority": 110,
              "protocol": "TCP",
              "sourceAddressPrefix": "",
              "sourcePortRange": "*"
            }
          }
　 + /subscriptions/<subscription-id>/resourceGroups/<resource-group-
name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-b [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
   ~ /subscriptions/<subscription-id>/resourceGroups/<resource-group-
name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"
    - tags.manage: "bicep"

Copy

az stack-whatif group create \
  --name "${STACK_WIF_NAME}-deny-delete" \
  ...
  --deny-settings-mode denyDelete \
  ...

Copy

Azure
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    = Management Status: "managed"
    ~ Deny Status: "none" => "denyDelete"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-b [2023-11-01]
    = Management Status: "managed"
    ~ Deny Status: "none" => "denyDelete"
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatifjllhctmmnuk3i [2023-01-01]
    = Management Status: "managed"
    ~ Deny Status: "none" => "denyDelete"

Copy

# 一覧
az stack-whatif group list --resource-group $RG

# 単一取得
az stack-whatif group show --name $STACK_WIF_NAME --resource-group $RG

# 削除
az stack-whatif group delete --name $STACK_WIF_NAME --resource-group $RG

Copy

$ az stack-whatif group list --resource-group $RG 
  --query "[].{Name:name}" -o table

Name
----------------------------------
stack-test-wif-result
stack-test-wif-result-nsga
stack-test-wif-result-st-grs
stack-test-wif-result-nsgb
stack-test-wif-result-check-action
stack-test-wif-result-check-drift
stack-test-wif-result-deny-delete

Copy

az stack-whatif group show \
  --name "${STACK_WIF_NAME}-st-grs" \
  --resource-group $RG

Copy

Azure
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a
    = Management Status: "managed"
    = Deny Status: "none"
  ~ /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatif7et6h4m5up5ze
    = Management Status: "managed"
    = Deny Status: "none"

Copy

az stack-whatif group show \
  --name "${STACK_WIF_NAME}-st-grs" \
  --resource-group $RG \
  --with-property-changes true

Copy

Azure
  = /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkSecurityGroups/nsg-whatif-a [2023-11-01]
    = Management Status: "managed"
    = Deny Status: "none"
  ~ /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Storage/storageAccounts/stwhatif7et6h4m5up5ze [2023-01-01]
    = Management Status: "managed"
    = Deny Status: "none"
    ~ sku.name: "Standard_LRS" => "Standard_GRS"
    ~ tags.env: "demo" => "test"

Copy

WARNING: [DeploymentStackWhatIfDiagnostic_StaleWhatIf]
  Message: The corresponding deployment stack has been deleted or updated since the what-if operation was run. For accurate what-if predictions, please re-run the deployment stack what-if.

Copy

# リソースグループごと削除
az group delete --name $RG

# スタックとその管理下のリソースを削除する場合
az stack group delete \
  --name $STACK_NAME \
  --resource-group $RG \
  --action-on-unmanage deleteAll

Copy