Skip to content

Commit eadb6f5

Browse files
mumianmumian
committed
update
1 parent f6542f8 commit eadb6f5

File tree

2 files changed

+42
-39
lines changed

2 files changed

+42
-39
lines changed

‎articles/azure-resource-manager/bicep/deployment-stacks.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ Deployment stacks provide the following benefits:
4141
- Deleting resource groups currently bypasses deny assignments. When creating a deployment stack in the resource group scope, the Bicep file doesn't contain the definition for the resource group. Despite the deny assignment setting, it's possible to delete the resource group and its contained stack. However, if a [lock](../management/lock-resources.md) is active on any resource within the group, the delete operation will fail.
4242
- The [What-if](./deploy-what-if.md) support is not yet available.
4343
- A management group-scoped stack is restricted from deploying to another management group. It can only deploy to the management group of the stack itself or to a child subscription.
44+
- The PowerShell command help lists a `DeleteResourcesAndResourcesGroups` value for the `ActionOnUnmanage` switch. When this value is used, the command detaches the managed resources and the resource groups. This value will be removed in the next update. Do not use this value.
4445

4546
## Create deployment stacks
4647

‎articles/azure-resource-manager/bicep/tutorial-use-deployment-stacks.md

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Use deployment stack with Bicep
33
description: Learn how to use Bicep to create and deploy a deployment stack.
4-
ms.date: 05/15/2024
4+
ms.date: 05/20/2024
55
ms.topic: tutorial
66
ms.custom: mode-api, devx-track-azurecli, devx-track-azurepowershell, devx-track-bicep
77
---
@@ -82,7 +82,7 @@ az stack group create \
8282
--deny-settings-mode 'none'
8383
```
8484

85-
The `deny-settings-mode` switch assigns a specific type of permissions to the managed resources, which prevents their deletion by unauthorized security principals. For more information, see [Protect managed resources against deletion](./deployment-stacks.md#protect-managed-resources-against-deletion).
85+
Use the `action-on-unmanage` switch to define what happens to resources that are no longer managed after a stack is updated or deleted. For more information, see [Control detachment and deletion](./deployment-stacks.md#control-detachment-and-deletion). The `deny-settings-mode` switch assigns a specific type of permissions to the managed resources, which prevents their deletion by unauthorized security principals. For more information, see [Protect managed resources against deletion](./deployment-stacks.md#protect-managed-resources-against-deletion).
8686

8787
# [PowerShell](#tab/azure-powershell)
8888

@@ -99,7 +99,7 @@ New-AzResourceGroupDeploymentStack `
9999
-DenySettingsMode "none"
100100
```
101101

102-
The `DenySettingsMode` switch assigns a specific type of permissions to the managed resources, which prevents their deletion by unauthorized security principals. For more information, see [Protect managed resources against deletion](./deployment-stacks.md#protect-managed-resources-against-deletion).
102+
Use the `ActionOnUnmanage` switch to define what happens to resources that are no longer managed after a stack is updated or deleted. For more information, see [Control detachment and deletion](./deployment-stacks.md#control-detachment-and-deletion). The `DenySettingsMode` switch assigns a specific type of permissions to the managed resources, which prevents their deletion by unauthorized security principals. For more information, see [Protect managed resources against deletion](./deployment-stacks.md#protect-managed-resources-against-deletion).
103103

104104
---
105105

@@ -134,14 +134,14 @@ The output shows two managed resources - one storage account and one virtual net
134134
"excludedPrincipals": null,
135135
"mode": "none"
136136
},
137-
"deploymentId": "/subscriptions/00000000-0000-0000-0000-000000000000/demoRg/providers/Microsoft.Resources/deployments/demoStack-2023-06-08-14-58-28-fd6bb",
137+
"deploymentId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deployments/demoStack-24051714epybc",
138138
"deploymentScope": null,
139139
"description": null,
140140
"detachedResources": [],
141-
"duration": "PT30.1685405S",
141+
"duration": "PT32.5330364S",
142142
"error": null,
143143
"failedResources": [],
144-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack",
144+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack",
145145
"location": null,
146146
"name": "demoStack",
147147
"outputs": null,
@@ -152,26 +152,26 @@ The output shows two managed resources - one storage account and one virtual net
152152
"resources": [
153153
{
154154
"denyStatus": "none",
155-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk",
155+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk",
156156
"resourceGroup": "demoRg",
157157
"status": "managed"
158158
},
159159
{
160160
"denyStatus": "none",
161-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/demoRg/providers/Microsoft.Storage/storageAccounts/storethmimleef5fwk",
161+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storethmimleef5fwk",
162162
"resourceGroup": "demoRg",
163163
"status": "managed"
164164
}
165165
],
166166
"systemData": {
167-
"createdAt": "2023-06-08T14:58:28.377564+00:00",
168-
"createdBy": "johndole@contoso.com",
167+
"createdAt": "2024-05-17T14:50:18.382948+00:00",
168+
"createdBy": "jgao@microsoft.com",
169169
"createdByType": "User",
170-
"lastModifiedAt": "2023-06-08T14:58:28.377564+00:00",
171-
"lastModifiedBy": "johndole@contoso.com",
170+
"lastModifiedAt": "2024-05-17T14:50:18.382948+00:00",
171+
"lastModifiedBy": "jgao@microsoft.com",
172172
"lastModifiedByType": "User"
173173
},
174-
"tags": null,
174+
"tags": {},
175175
"template": null,
176176
"templateLink": null,
177177
"type": "Microsoft.Resources/deploymentStacks"
@@ -189,16 +189,18 @@ Get-AzResourceGroupDeploymentStack `
189189
The output shows two managed resources - one storage account and one virtual network:
190190

191191
```output
192-
Id : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack
193-
Name : demoStack
194-
ProvisioningState : succeeded
195-
ResourcesCleanupAction : detach
196-
ResourceGroupsCleanupAction : detach
197-
DenySettingsMode : none
198-
CreationTime(UTC) : 6/5/2023 8:55:48 PM
199-
DeploymentId : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deployments/demoStack-2023-06-05-20-55-48-38d09
200-
Resources : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetzu6pnx54hqubm
201-
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storezu6pnx54hqubm
192+
Id : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack
193+
Name : demoStack
194+
ProvisioningState : succeeded
195+
resourcesCleanupAction : detach
196+
resourceGroupsCleanupAction : detach
197+
managementGroupsCleanupAction : detach
198+
CorrelationId : 62f1631c-a823-46c1-b240-9182ccf39cfa
199+
DenySettingsMode : none
200+
CreationTime(UTC) : 5/17/2024 3:37:42 PM
201+
DeploymentId : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deployments/demoStack-24051715b17ls
202+
Resources : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk
203+
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storethmimleef5fwk
202204
```
203205

204206
---
@@ -231,11 +233,11 @@ The output is similar to:
231233
"excludedPrincipals": null,
232234
"mode": "none"
233235
},
234-
"deploymentId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deployments/demoStack-2023-06-05-20-55-48-38d09",
236+
"deploymentId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deployments/demoStack-24051714epybc",
235237
"deploymentScope": null,
236238
"description": null,
237239
"detachedResources": [],
238-
"duration": "PT29.006353S",
240+
"duration": "PT32.5330364S",
239241
"error": null,
240242
"failedResources": [],
241243
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Resources/deploymentStacks/demoStack",
@@ -249,26 +251,26 @@ The output is similar to:
249251
"resources": [
250252
{
251253
"denyStatus": "none",
252-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetzu6pnx54hqubm",
254+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk",
253255
"resourceGroup": "demoRg",
254256
"status": "managed"
255257
},
256258
{
257259
"denyStatus": "none",
258-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storezu6pnx54hqubm",
260+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storethmimleef5fwk",
259261
"resourceGroup": "demoRg",
260262
"status": "managed"
261263
}
262264
],
263265
"systemData": {
264-
"createdAt": "2023-06-05T20:55:48.006789+00:00",
265-
"createdBy": "johndole@contoso.com",
266+
"createdAt": "2024-05-17T14:50:18.382948+00:00",
267+
"createdBy": "jgao@microsoft.com",
266268
"createdByType": "User",
267-
"lastModifiedAt": "2023-06-05T20:55:48.006789+00:00",
268-
"lastModifiedBy": "johndole@contoso.com",
269+
"lastModifiedAt": "2024-05-17T14:50:18.382948+00:00",
270+
"lastModifiedBy": "jgao@microsoft.com",
269271
"lastModifiedByType": "User"
270272
},
271-
"tags": null,
273+
"tags": {},
272274
"template": null,
273275
"templateLink": null,
274276
"type": "Microsoft.Resources/deploymentStacks"
@@ -286,8 +288,8 @@ The output is similar to:
286288
```output
287289
Status DenyStatus Id
288290
------ ---------- --
289-
managed none /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetzu6pnx54hqubm
290-
managed none /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storezu6pnx54hqubm
291+
managed none /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Network/virtualNetworks/vnetthmimleef5fwk
292+
managed none /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demoRg/providers/Microsoft.Storage/storageAccounts/storethmimleef5fwk
291293
```
292294

293295
---
@@ -311,7 +313,7 @@ At the end of the previous step, you have one stack with two managed resources.
311313
Edit the **main.bicep** file to change the sku name from `Standard_LRS` to `Standard_GRS`:
312314

313315
```bicep
314-
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
316+
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-04-01' = {
315317
name: storageAccountName
316318
location: location
317319
kind: 'StorageV2'
@@ -368,7 +370,7 @@ At the end of the previous step, you have one stack with two managed resources.
368370
Edit the **main.bicep** file to include another storage account definition:
369371

370372
```bicep
371-
resource storageAccount1 'Microsoft.Storage/storageAccounts@2022-09-01' = {
373+
resource storageAccount1 'Microsoft.Storage/storageAccounts@2023-04-01' = {
372374
name: '1${storageAccountName}'
373375
location: location
374376
kind: 'StorageV2'
@@ -432,7 +434,7 @@ At the end of the previous step, you have one stack with three managed resources
432434
Edit the **main.bicep** file to remove the following storage account definition from the previous step:
433435

434436
```bicep
435-
resource storageAccount1 'Microsoft.Storage/storageAccounts@2022-09-01' = {
437+
resource storageAccount1 'Microsoft.Storage/storageAccounts@2023-04-01' = {
436438
name: '1${storageAccountName}'
437439
location: location
438440
kind: 'StorageV2'
@@ -512,7 +514,7 @@ At the end of the previous step, you have one stack with two managed resources.
512514
Edit the **main.bicep** file to include the storage account definition of the unmanaged resource:
513515

514516
```bicep
515-
resource storageAccount1 'Microsoft.Storage/storageAccounts@2022-09-01' = {
517+
resource storageAccount1 'Microsoft.Storage/storageAccounts@2023-04-01' = {
516518
name: '1${storageAccountName}'
517519
location: location
518520
kind: 'StorageV2'
@@ -576,7 +578,7 @@ At the end of the previous step, you have one stack with three managed resources
576578
Edit the **main.bicep** file to remove the following storage account definition:
577579

578580
```bicep
579-
resource storageAccount1 'Microsoft.Storage/storageAccounts@2022-09-01' = {
581+
resource storageAccount1 'Microsoft.Storage/storageAccounts@2023-04-01' = {
580582
name: '1${storageAccountName}'
581583
location: location
582584
kind: 'StorageV2'

0 commit comments

Comments
 (0)