How to filter by Resource Group

[phil-tao]

Hi,

I am trying to set up the config.yml file to exclude by resource group.
Below is my config file:

regions:
  # - global
  - eastus


account-blocklist:
  - xxxxxx-ae5b-42d4-a86d-xxxxxx

accounts:
  xxxxxxx-a3e7-45be-b8a4-xxxxx:
    filters:
      AzureADUser:
        - property: Name
          type: glob
          value: "*gmail.com"
      ServicePrincipal:
        - type: contains
          property: Name
          value: azure-nuke
      ResourceGroup:
        - Default
        - NetworkWatcherRG
        - DefaultResourceGroup-EUS
        - DefaultResourceGroup-EUS2
        - Jake-test
        - NetworkWatcherRG
        - sajrgsb2
        - subharsg01
        - vrunda-rg

I ran the command below to list the resources:

azure-nuke nuke \
--config=./config-sb2.yml \
--tenant-id=xxxxxxx-a3e7-45be-b8a4-xxxxx

Below is the partial output from the azure-nuke command:

sub/xxxxxxxxx - ResourceGroup - cloud-shell-storage-centralindia - [Name: "cloud-shell-storage-centralindia", Region: "centralindia", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - NetworkWatcherRG - [Name: "NetworkWatcherRG", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - vrunda-rg - [Name: "vrunda-rg", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - DefaultResourceGroup-EUS - [Name: "DefaultResourceGroup-EUS", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - sajrgsb2 - [Name: "sajrgsb2", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5", tag:az: "sb2", tag:owner: "saj"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - Jake-test - [Name: "Jake-test", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5", tag:jake: "test"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - CloudOneConformityMonitoring-3Y69hmr06 - [Name: "CloudOneConformityMonitoring-3Y69hmr06", Region: "westus2", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - cloud-shell-storage-westus - [Name: "cloud-shell-storage-westus", Region: "westus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - DefaultResourceGroup-EUS2 - [Name: "DefaultResourceGroup-EUS2", Region: "eastus2", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - ResourceGroup - subharsg01 - [Name: "subharsg01", Region: "eastus2", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config
sub/xxxxxxxxx - SSHPublicKey - sajvm2_key - [Name: "sajvm2_key", Region: "eastus", ResourceGroup: "SAJRGSB2"] - would remove
sub/xxxxxxxxx - SSHPublicKey - sajvmtk1_key - [Name: "sajvmtk1_key", Region: "eastus2", ResourceGroup: "SAJRGSB2", tag:owner: "saj"] - filtered by config
rg/vrunda-rg - AppServicePlan - ASP-vrundarg-9e58 - [Name: "ASP-vrundarg-9e58", ResourceGroup: "vrunda-rg"] - filtered by config
rg/sajrgsb2 - VirtualNetwork - sajvm2-vnet - [Name: "sajvm2-vnet", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - VirtualNetwork - sajvmtk1-vnet - [Name: "sajvmtk1-vnet", Region: "eastus2", ResourceGroup: "sajrgsb2", tag:owner: "saj"] - filtered by config
rg/sajrgsb2 - NetworkSecurityGroup - sajvm2-nsg - [Name: "sajvm2-nsg", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - PublicIPAddresses - sajvm2-ip - [Name: "sajvm2-ip", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - NetworkInterface - sajvm2796_z1 - [Name: "sajvm2796_z1", Region: "eastus", ResourceGroup: "sajrgsb2", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - would remove

My questions are:

1. If I want azure-nuke to exclude by resource group, is below the correct syntax?

filters:
  ResourceGroup:
          - Default
          - NetworkWatcherRG

2. Why the resource group cloud-shell-storage-centralindia is filtered out if it is not specified in the filter list:

sub/xxxxxxxxx - ResourceGroup - cloud-shell-storage-centralindia - [Name: "cloud-shell-storage-centralindia", Region: "centralindia", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - filtered by config

3. The message below means azure-nuke will not nuke resources within the resource group sajrgsb2
sub/xxxxxxxxx - ResourceGroup - sajrgsb2 - [Name: "sajrgsb2", Region: "eastus", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5", tag:az: "sb2", tag:owner: "saj"] - filtered by config

The messages below are confusing, sajrgsb2 resource group is in the filtered list, but several resources in the sajrgsb2 resource group are tagged "will be removed". There are a total of 12 resources in the resource group, but why will five of them be removed?

rg/sajrgsb2 - VirtualNetwork - sajvm2-vnet - [Name: "sajvm2-vnet", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - VirtualNetwork - sajvmtk1-vnet - [Name: "sajvmtk1-vnet", Region: "eastus2", ResourceGroup: "sajrgsb2", tag:owner: "saj"] - filtered by config
rg/sajrgsb2 - NetworkSecurityGroup - sajvm2-nsg - [Name: "sajvm2-nsg", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - PublicIPAddresses - sajvm2-ip - [Name: "sajvm2-ip", Region: "eastus", ResourceGroup: "sajrgsb2"] - would remove
rg/sajrgsb2 - NetworkInterface - sajvm2796_z1 - [Name: "sajvm2796_z1", Region: "eastus", ResourceGroup: "sajrgsb2", SubscriptionID: "xxxxxxxxx-fc10-47fb-9940-6c844ec628d5"] - would remove

Could someone please help with my questions?

[ekristen]

Thanks for using the discussion section!

I'm going to be merging and releasing documentation soon to help with this.

If you are using the next/beta build the global filters are a thing. If you are using 0.x then global is not a thing.

1. All resources have to be filtered by their type or by using the special global resource type. Specifying the ResourceGroup only filters the ResourceGroup itself not resources contained within.

2. There is now way to limit queries in a sensible way to only return resources from a specific set of regions, to keep this tool aligned with the libnuke library and aws-nuke regions are part of the configuration. --- Therefore regions act as a global filter, if region is not in the regions list or all is not present those resources get filtered. Thus why centralindia is filtered. I'm working on a better filter message for this.

3. See response to number 1 - you have to filter resources individually by type or by using global (if using next builds).

The current docs are here they'll get published soon. https://github.com/ekristen/azure-nuke/tree/next/docs

[phil-tao]

@ekristen
Thanks for your reply.

I am using azure-nuke -v
azure-nuke version 1.0.0-next.11

The documentation is helpful, and I will read through them.