Why is it possible to move resources to read-only resource groups in Azure?

user_15703548 0
Viewed 1431

I was testing locks in Azure and I don't get the logic behind locks on resource groups when moving resources.

Example

RG "Lab"

No lock

contains storage account "labstorage"

RG "Production"

Read-only lock

contains storage account "productionstorage"

Behavior

  • Trying to add a new storage account to RG Production

    • fails (as expected)

  • Move storage account labstorage from RG Lab to RG Production

    • works

Why is the move operation successful? When the lock prevents me from adding new resources why would it allow me to move resources to it? Feels like circumventing the lock by creating resources elsewhere.

Is there any logic behind this, so I can understand?

azure
1 Answers

Locks on storage accounts are one of the few things that act “weird”. App services being another.

Storage accounts have security controls around them linking the storage account to the tenant it belongs to.

When any action occurs against a storage account an API makes a post action to the storage subsystem.

When the read only lock is applied then everything fails because of that post API call in the storage stack.

Locks prevents changes such as deletions or modifications but you can add services and resources to the group. They then inherent the lock.

user_84879010
Related