Skip to content

Commit 3f9901a

Browse files
Merge pull request #275513 from mumian/0515-stacks-unmanage
Stacks - Update action-on-unmanage
2 parents 9f6dcc7 + 6f3ba72 commit 3f9901a

File tree

5 files changed

+292
-224
lines changed

5 files changed

+292
-224
lines changed

articles/azure-resource-manager/bicep/deployment-stacks.md

Lines changed: 60 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Create & deploy deployment stacks in Bicep
33
description: Describes how to create deployment stacks in Bicep.
44
ms.topic: conceptual
55
ms.custom: devx-track-azurecli, devx-track-azurepowershell, devx-track-bicep
6-
ms.date: 04/11/2024
6+
ms.date: 05/22/2024
77
---
88

99
# Deployment stacks
@@ -33,14 +33,15 @@ Deployment stacks provide the following benefits:
3333

3434
- Implicitly created resources aren't managed by the stack. Therefore, no deny assignments or cleanup is possible.
3535
- Deny assignments don't support tags.
36-
- Deny assignments is not supported within the management group scope.
36+
- Deny assignments are not supported at the management group scope. However, they are supported in a management group stack if the deployment is pointed at the subscription scope.
3737
- Deployment stacks cannot delete Key vault secrets. If you're removing key vault secrets from a template, make sure to also execute the deployment stack update/delete command with detach mode.
3838

3939
### Known issues
4040

4141
- Deleting resource groups currently bypasses deny assignments. When creating a deployment stack in the resource group scope, the Bicep file doesn't contain the definition for the resource group. Despite the deny assignment setting, it's possible to delete the resource group and its contained stack. However, if a [lock](../management/lock-resources.md) is active on any resource within the group, the delete operation will fail.
42-
- [What-if](./deploy-what-if.md) isn't available in the preview.
42+
- The [What-if](./deploy-what-if.md) support is not yet available.
4343
- A management group-scoped stack is restricted from deploying to another management group. It can only deploy to the management group of the stack itself or to a child subscription.
44+
- The PowerShell command help lists a `DeleteResourcesAndResourcesGroups` value for the `ActionOnUnmanage` switch. When this value is used, the command detaches the managed resources and the resource groups. This value will be removed in the next update. Do not use this value.
4445

4546
## Create deployment stacks
4647

@@ -63,6 +64,7 @@ New-AzResourceGroupDeploymentStack `
6364
-Name "<deployment-stack-name>" `
6465
-ResourceGroupName "<resource-group-name>" `
6566
-TemplateFile "<bicep-file-name>" `
67+
-ActionOnUnmanage "detachAll" `
6668
-DenySettingsMode "none"
6769
```
6870

@@ -73,6 +75,7 @@ az stack group create \
7375
--name '<deployment-stack-name>' \
7476
--resource-group '<resource-group-name>' \
7577
--template-file '<bicep-file-name>' \
78+
--action-on-unmanage 'detachAll'
7679
--deny-settings-mode 'none'
7780
```
7881

@@ -92,6 +95,7 @@ New-AzSubscriptionDeploymentStack `
9295
-Location "<location>" `
9396
-TemplateFile "<bicep-file-name>" `
9497
-DeploymentResourceGroupName "<resource-group-name>" `
98+
-ActionOnUnmanage "detachAll" `
9599
-DenySettingsMode "none"
96100
```
97101

@@ -105,6 +109,7 @@ az stack sub create \
105109
--location '<location>' \
106110
--template-file '<bicep-file-name>' \
107111
--deployment-resource-group' <resource-group-name>' \
112+
--action-on-unmanage 'detachAll' \
108113
--deny-settings-mode 'none'
109114
```
110115

@@ -126,6 +131,7 @@ New-AzManagmentGroupDeploymentStack `
126131
-Location "<location>" `
127132
-TemplateFile "<bicep-file-name>" `
128133
-DeploymentSubscriptionId "<subscription-id>" `
134+
-ActionOnUnmanage "detachAll" `
129135
-DenySettingsMode "none"
130136
```
131137

@@ -139,6 +145,7 @@ az stack mg create \
139145
--location '<location>' \
140146
--template-file '<bicep-file-name>' \
141147
--deployment-subscription '<subscription-id>' \
148+
--action-on-unmanage 'detachAll' \
142149
--deny-settings-mode 'none'
143150
```
144151

@@ -239,6 +246,7 @@ Set-AzResourceGroupDeploymentStack `
239246
-Name "<deployment-stack-name>" `
240247
-ResourceGroupName "<resource-group-name>" `
241248
-TemplateFile "<bicep-file-name>" `
249+
-ActionOnUnmanage "detachAll" `
242250
-DenySettingsMode "none"
243251
```
244252

@@ -249,6 +257,7 @@ az stack group create \
249257
--name '<deployment-stack-name>' \
250258
--resource-group '<resource-group-name>' \
251259
--template-file '<bicep-file-name>' \
260+
--action-on-unmanage 'detachAll' \
252261
--deny-settings-mode 'none'
253262
```
254263

@@ -267,10 +276,11 @@ To update a deployment stack at the subscription scope:
267276

268277
```azurepowershell
269278
Set-AzSubscriptionDeploymentStack `
270-
-Name "<deployment-stack-name>" `
271-
-Location "<location>" `
272-
-TemplateFile "<bicep-file-name>" `
273-
-DeploymentResourceGroupName "<resource-group-name>" `
279+
-Name "<deployment-stack-name>" `
280+
-Location "<location>" `
281+
-TemplateFile "<bicep-file-name>" `
282+
-DeploymentResourceGroupName "<resource-group-name>" `
283+
-ActionOnUnmanage "detachAll" `
274284
-DenySettingsMode "none"
275285
```
276286

@@ -284,6 +294,7 @@ az stack sub create \
284294
--location '<location>' \
285295
--template-file '<bicep-file-name>' \
286296
--deployment-resource-group '<resource-group-name>' \
297+
--action-on-unmanage 'detachAll' \
287298
--deny-settings-mode 'none'
288299
```
289300

@@ -303,6 +314,7 @@ Set-AzManagmentGroupDeploymentStack `
303314
-Location "<location>" `
304315
-TemplateFile "<bicep-file-name>" `
305316
-DeploymentSubscriptionId "<subscription-id>" `
317+
-ActionOnUnmanage "detachAll" `
306318
-DenySettingsMode "none"
307319
```
308320

@@ -314,6 +326,7 @@ az stack mg create \
314326
--location '<location>' \
315327
--template-file '<bicep-file-name>' \
316328
--deployment-subscription '<subscription-id>' \
329+
--action-on-unmanage 'detachAll' \
317330
--deny-settings-mode 'none'
318331
```
319332

@@ -337,13 +350,15 @@ For more information, see [Create deployment stacks](#create-deployment-stacks).
337350

338351
A detached resource (or unmanaged resource) refers to a resource that isn't tracked or managed by the deployment stack but still exists within Azure.
339352

340-
To instruct Azure to delete unmanaged resources, update the stack with the create stack command with one of the following delete flags. For more information, see [Create deployment stack](#create-deployment-stacks).
353+
To instruct Azure to delete unmanaged resources, update the stack with the create stack command with the following switch. For more information, see [Create deployment stack](#create-deployment-stacks).
341354

342355
# [PowerShell](#tab/azure-powershell)
343356

344-
- `DeleteAll`: use delete rather than detach for managed resources and resource groups.
345-
- `DeleteResources`: use delete rather than detach for managed resources only.
346-
- `DeleteResourceGroups`: use delete rather than detach for managed resource groups only. It's invalid to use `DeleteResourceGroups` by itself. `DeleteResourceGroups` must be used together with `DeleteResources`.
357+
Use the `ActionOnUnmanage` switch to define what happens to resources that are no longer managed after a stack is updated or deleted. Allowed values are:
358+
359+
- `deleteAll`: use delete rather than detach for managed resources and resource groups.
360+
- `deleteResources`: use delete rather than detach for managed resources only.
361+
- `detachAll`: detach the managed resources and resource groups.
347362

348363
For example:
349364

@@ -352,15 +367,16 @@ New-AzSubscriptionDeploymentStack `
352367
-Name "<deployment-stack-name" `
353368
-TemplateFile "<bicep-file-name>" `
354369
-DenySettingsMode "none" `
355-
-DeleteResourceGroups `
356-
-DeleteResources
370+
-ActionOnUnmanage "deleteAll"
357371
```
358372

359373
# [CLI](#tab/azure-cli)
360374

361-
- `delete-all`: use delete rather than detach for managed resources and resource groups.
362-
- `delete-resources`: use delete rather than detach for managed resources only.
363-
- `delete-resource-groups`: use delete rather than detach for managed resource groups only. It"s invalid to use `delete-resource-groups` by itself. `delete-resource-groups` must be used together with `delete-resources`.
375+
Use the `action-on-unmanage` switch to define what happens to resources that are no longer managed after a stack is updated or deleted. Allowed values are:
376+
377+
- `deleteAll`: use delete rather than detach for managed resources and resource groups.
378+
- `deleteResources`: use delete rather than detach for managed resources only.
379+
- `detachAll`: detach the managed resources and resource groups.
364380

365381
For example:
366382

@@ -369,9 +385,8 @@ az stack sub create `
369385
--name '<deployment-stack-name>' `
370386
--location '<location>' `
371387
--template-file '<bicep-file-name>' `
372-
--deny-settings-mode 'none' `
373-
--delete-resource-groups `
374-
--delete-resources
388+
--action-on-unmanage 'deleteAll' `
389+
--deny-settings-mode 'none'
375390
```
376391

377392
# [Portal](#tab/azure-portal)
@@ -381,25 +396,25 @@ Currently not implemented.
381396
---
382397

383398
> [!WARNING]
384-
> When deleting resource groups with either the `DeleteAll` or `DeleteResourceGroups` properties, the managed resource groups and all the resources contained within them will also be deleted.
399+
> When deleting resource groups with the action-on-unmanage switch set to `DeleteAll`, the managed resource groups and all the resources contained within them will also be deleted.
385400
386401
## Delete deployment stacks
387402

388403
# [PowerShell](#tab/azure-powershell)
389404

390-
If you run the delete commands without the delete flags, the unmanaged resources will be detached but not deleted. To delete the unmanaged resources, use the following switches:
405+
The `ActionOnUnmanage` switch defines the action to the resources that are no longer managed. The switch has the following values:
391406

392407
- `DeleteAll`: Delete both the resources and the resource groups.
393408
- `DeleteResources`: Delete the resources only.
394-
- `DeleteResourceGroups`: Delete the resource groups only.
409+
- `DetachAll`: Detach the resources.
395410

396411
# [CLI](#tab/azure-cli)
397412

398-
If you run the delete commands without the delete flags, the unmanaged resources will be detached but not deleted. To delete the unmanaged resources, use the following switches:
413+
The `action-on-unmanage` switch defines the action to the resources that are no longer managed. The switch has the following values:
399414

400415
- `delete-all`: Delete both the resources and the resource groups.
401416
- `delete-resources`: Delete the resources only.
402-
- `delete-resource-groups`: Delete the resource groups only.
417+
- `detach-all`: Detach the resources.
403418

404419
# [Portal](#tab/azure-portal)
405420

@@ -419,7 +434,7 @@ To delete deployment stack resources at the resource group scope:
419434
Remove-AzResourceGroupDeploymentStack `
420435
-name "<deployment-stack-name>" `
421436
-ResourceGroupName "<resource-group-name>" `
422-
[-DeleteAll/-DeleteResourceGroups/-DeleteResources]
437+
-ActionOnUnmanage "<deleteAll/deleteResources/detachAll>"
423438
```
424439

425440
# [CLI](#tab/azure-cli)
@@ -428,7 +443,7 @@ Remove-AzResourceGroupDeploymentStack `
428443
az stack group delete \
429444
--name '<deployment-stack-name>' \
430445
--resource-group '<resource-group-name>' \
431-
[--delete-all/--delete-resource-groups/--delete-resources]
446+
--action-on-unmanage '<deleteAll/deleteResources/detachAll>'
432447
```
433448

434449
# [Portal](#tab/azure-portal)
@@ -451,15 +466,15 @@ To delete deployment stack resources at the subscription scope:
451466
```azurepowershell
452467
Remove-AzSubscriptionDeploymentStack `
453468
-Name "<deployment-stack-name>" `
454-
[-DeleteAll/-DeleteResourceGroups/-DeleteResources]
469+
-ActionOnUnmanage "<deleteAll/deleteResources/detachAll>"
455470
```
456471

457472
# [CLI](#tab/azure-cli)
458473

459474
```azurecli
460475
az stack sub delete \
461476
--name '<deployment-stack-name>' \
462-
[--delete-all/--delete-resource-groups/--delete-resources]
477+
--action-on-unmanage '<deleteAll/deleteResources/detachAll>'
463478
```
464479

465480
# [Portal](#tab/azure-portal)
@@ -482,7 +497,7 @@ To delete deployment stack resources at the management group scope:
482497
Remove-AzManagementGroupDeploymentStack `
483498
-Name "<deployment-stack-name>" `
484499
-ManagementGroupId "<management-group-id>" `
485-
[-DeleteAll/-DeleteResourceGroups/-DeleteResources]
500+
-ActionOnUnmanage "<deleteAll/deleteResources/detachAll>"
486501
```
487502

488503
# [CLI](#tab/azure-cli)
@@ -491,7 +506,7 @@ Remove-AzManagementGroupDeploymentStack `
491506
az stack mg delete \
492507
--name '<deployment-stack-name>' \
493508
--management-group-id '<management-group-id>' \
494-
[--delete-all/--delete-resource-groups/--delete-resources]
509+
--action-on-unmanage '<deleteAll/deleteResources/detachAll>'
495510
```
496511

497512
# [Portal](#tab/azure-portal)
@@ -502,7 +517,7 @@ Currently not implemented.
502517

503518
## View managed resources in deployment stack
504519

505-
During public preview, the deployment stack service doesn't yet have an Azure portal graphical user interface (GUI). To view the managed resources inside a deployment stack, use the following Azure Powershell/Azure CLI commands:
520+
The deployment stack service doesn't yet have an Azure portal graphical user interface (GUI). To view the managed resources inside a deployment stack, use the following Azure Powershell/Azure CLI commands:
506521

507522
To view managed resources at the resource group scope:
508523

@@ -625,7 +640,8 @@ New-AzResourceGroupDeploymentStack `
625640
-Name "<deployment-stack-name>" `
626641
-ResourceGroupName "<resource-group-name>" `
627642
-TemplateFile "<bicep-file-name>" `
628-
-DenySettingsMode "DenyDelete" `
643+
-ActionOnUnmanage "detachAll" `
644+
-DenySettingsMode "denyDelete" `
629645
-DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" `
630646
-DenySettingsExcludedPrincipal "<object-id>,<object-id>"
631647
```
@@ -637,6 +653,7 @@ az stack group create \
637653
--name '<deployment-stack-name>' \
638654
--resource-group '<resource-group-name>' \
639655
--template-file '<bicep-file-name>' \
656+
--action-on-unmanage 'detachAll' \
640657
--deny-settings-mode 'denyDelete' \
641658
--deny-settings-excluded-actions 'Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete' \
642659
--deny-settings-excluded-principals '<object-id> <object-id>'
@@ -657,7 +674,8 @@ New-AzSubscriptionDeploymentStack `
657674
-Name "<deployment-stack-name>" `
658675
-Location "<location>" `
659676
-TemplateFile "<bicep-file-name>" `
660-
-DenySettingsMode "DenyDelete" `
677+
-ActionOnUnmanage "detachAll" `
678+
-DenySettingsMode "denyDelete" `
661679
-DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" `
662680
-DenySettingsExcludedPrincipal "<object-id>,<object-id>"
663681
```
@@ -671,6 +689,7 @@ az stack sub create \
671689
--name '<deployment-stack-name>' \
672690
--location '<location>' \
673691
--template-file '<bicep-file-name>' \
692+
--action-on-unmanage 'detachAll' \
674693
--deny-settings-mode 'denyDelete' \
675694
--deny-settings-excluded-actions 'Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete' \
676695
--deny-settings-excluded-principals '<object-id> <object-id>'
@@ -693,7 +712,8 @@ New-AzManagmentGroupDeploymentStack `
693712
-Name "<deployment-stack-name>" `
694713
-Location "<location>" `
695714
-TemplateFile "<bicep-file-name>" `
696-
-DenySettingsMode "DenyDelete" `
715+
-ActionOnUnmanage "detachAll" `
716+
-DenySettingsMode "denyDelete" `
697717
-DenySettingsExcludedActions "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" `
698718
-DenySettingsExcludedPrincipal "<object-id>,<object-id>"
699719
```
@@ -707,6 +727,7 @@ az stack mg create \
707727
--name '<deployment-stack-name>' \
708728
--location '<location>' \
709729
--template-file '<bicep-file-name>' \
730+
--action-on-unmanage 'detachAll' \
710731
--deny-settings-mode 'denyDelete' \
711732
--deny-settings-excluded-actions 'Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete' \
712733
--deny-settings-excluded-principals '<object-id> <object-id>'
@@ -734,8 +755,8 @@ To export a deployment stack at the resource group scope:
734755

735756
```azurepowershell
736757
Save-AzResourceGroupDeploymentStack `
737-
-Name '<deployment-stack-name>' `
738-
-ResourceGroupName '<resource-group-name>' `
758+
-Name "<deployment-stack-name>" `
759+
-ResourceGroupName "<resource-group-name>" `
739760
```
740761

741762
# [CLI](#tab/azure-cli)
@@ -758,7 +779,7 @@ To export a deployment stack at the subscription scope:
758779

759780
```azurepowershell
760781
Save-AzSubscriptionDeploymentStack `
761-
-name '<deployment-stack-name>'
782+
-name "<deployment-stack-name>"
762783
```
763784

764785
# [CLI](#tab/azure-cli)
@@ -780,8 +801,8 @@ To export a deployment stack at the management group scope:
780801

781802
```azurepowershell
782803
Save-AzManagmentGroupDeploymentStack `
783-
-Name '<deployment-stack-name>' `
784-
-ManagementGroupId '<management-group-id>'
804+
-Name "<deployment-stack-name>" `
805+
-ManagementGroupId "<management-group-id>"
785806
```
786807

787808
# [CLI](#tab/azure-cli)
5.48 KB
Loading

0 commit comments

Comments
 (0)