Able to change tags on resource group when using --deny-settings-mode 'denyWriteAndDelete'

Open
#151 6 comments 0 reactions 1 assignee View on GitHub

@aperezmicrosoft is already working on this.

Since Feb 15, 2024.

Assessment

This issue has not been assessed yet.

Description

feature request needs upvote

Describe the bug
I have a bicep file that deploy's two resource groups and in those resource groups a storage account. On the stack deployment we specify --deny-settings-mode 'denyWriteAndDelete'. When we try to update the tags on the resources it does not work as expected but when we alter the tags on the resource groups within the stacks it is possible.

Would like to know if this is by design, known limitation or a bug.

To Reproduce
Steps to reproduce the behavior:

  1. Create a bicep file with a resource group in it.

  2. Deploy as a stack this is the code we used
    az stack sub create --name 'stack-demo-02' --template-file '.\demo-02\main.bicep' --parameters '.\demo-02\main-param.bicepparam' --location 'westeurope' --deny-settings-mode 'denyWriteAndDelete' --deny-settings-apply-to-child-scopes

  3. Try altering the tags on the resource group.

  4. The tags are updated on the resource group.

Expected behavior
I would expect that I'm disallowed to update the tags

Dominant language
Bicep
Stars
101
Forks
13
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Azure/deployment-stacks

All issues in Azure/deployment-stacks

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.