3 ms·
You can do it both in Terraform and also at the resource level in Azure itself.
by disordinary 5y ago
You can do it both in Terraform and also at the resource level in Azure itself.
- jiggawatts 5y agoThat's chock full of bugs unfortunately. For example, if you lock an Azure DNS Zone to prevent it being deleted, you then cannot delete any DNS record under it! It's a strict hierarchy, there's no way to turn off the inheritance. (It is possible to create a custom RBAC role that excludes zone deletion only, but this is very fiddly and not-quite-the-same in complex ways.)