Change to delete locks and add additional

frasermolyneux · Dec 9, 2023 · be63920 · be63920
1 parent 93f39e4
commit be63920
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/terraform/app_data_storage.tf b/terraform/app_data_storage.tf
@@ -21,6 +21,13 @@ resource "azurerm_storage_account" "app_data_storage" {
   tags = var.tags
 }
 
+resource "azurerm_management_lock" "app_data_storage_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_storage_account.app_data_storage.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}
+
 resource "azurerm_storage_container" "ban_files_container" {
   name = "ban-files"
 

diff --git a/terraform/common.tf b/terraform/common.tf
@@ -6,8 +6,8 @@ resource "azurerm_resource_group" "rg" {
 }
 
 resource "azurerm_management_lock" "rg_lock" {
-  name       = "Terraform (ReadOnly) - ${random_id.lock.hex}"
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
   scope      = azurerm_resource_group.rg.id
-  lock_level = "ReadOnly"
-  notes      = "ReadOnly Lock managed by Terraform to prevent manual or accidental modification of resource group and resources"
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
 }
diff --git a/terraform/key_vault.tf b/terraform/key_vault.tf
@@ -18,6 +18,13 @@ resource "azurerm_key_vault" "kv" {
   }
 }
 
+resource "azurerm_management_lock" "kv_lock" {
+  name       = "Terraform (CanNotDelete) - ${random_id.lock.hex}"
+  scope      = azurerm_key_vault.kv.id
+  lock_level = "CanNotDelete"
+  notes      = "CanNotDelete Lock managed by Terraform to prevent manual or accidental deletion of resource group and resources"
+}
+
 resource "azurerm_role_assignment" "web_app_kv_role_assignment" {
   scope                = azurerm_key_vault.kv.id
   role_definition_name = "Key Vault Secrets User"