Decommission Azure resources imported out of a Guardrails Workspace
Guardrails natively allows an administrator to remove Azure resources (tenant, management group, active directory, subscription) from a Guardrails workspace. The delete action removes any associated policies and references in the database, but NO RESOURCES ARE DELETED FROM THE TARGET AZURE RESOURCES. Careful consideration must be made when removing cloud resources as once data is deleted, such as Action Group and Activity Log Alert, it cannot be retrieved.
Before the delete process is started, administrators will want to determine if they would like to keep Turbot resources such as Action Group and Activity Log Alert. The following policies can be set at the required resource (tenant, management group, active directory, subscription) level within Guardrails to facilitate cleanup.
Azure > Turbot > Permissionsset to
Enforce: None. This will remove Guardrails-managed IAM policies, roles and users.
Azure > Turbot > Resource Groupset to
Enforce: Not configured. This will remove the Guardrails configured resource group.
Azure > Turbot > Event Handlersset to
Enforce: Not configured. This will remove Guardrails created Action Group and Activity Log Alert.
Azure > Turbot > Event Pollerto
Disabled. This will disable the pulling of events into Guardrails for processing.
Azure > Turbot > Management Group Event Pollerto
Disabled. This will stop discovering of events into Guardrails.
Azure > Turbot > Directory Event Pollerto
Disabled. This will disable the pulling of events into Guardrails.
Once the controls associated with the above policies have completed, the Azure subscription can be deleted from Guardrails. Any combination of the policies can be used to target specific resources while leaving important audit logging data available.
Steps to remove an Azure resources from Guardrails
Prior to performing the below steps, delete the
Azure > Client ID,
Azure > Client Key,
Azure > Environment and
Azure > Tenant ID configured on the
target resource. Once they have been removed, the Azure resource can be deleted from Turbot.
- Using the Turbot UI, navigate to the resource (tenant, subscription, management group and active directory) that needs to be removed from Turbot.
- Click the Delete button in the top right. If you do not see the delete button, reach out to your Turbot administrator for proper access.
- In the pop up window, copy the resource ID and paste in the text box.
Delete. While this is not irreversible (simply reimport the resource), it can be time and resource consuming. Be sure to double and triple check!
- Turbot will begin the delete process. The time to complete the deletion will depend on the number of resources and policies that will be removed. The more resources that are being deleted, the longer the process will take.
An error in deleting an Azure resource may occur; the delete function is a complex SQL transaction, and failures in referential integrity or other blocking/locking database activity can cause the delete to fail.
If an error message is encountered, ensure that all of the Turbot event handlers for that Azure resource is removed so
no new transactions are incoming and try again. It may take several attempts to delete the Azure resource. If the
deletion error persists for more than several hours after removing the event handlers, and you have verified that no
Azure resource activity is taking place in the
Activity tab, please open a ticket with Turbot support.