Azure CLI – Finding Azure Resources Missing a Specific Tag

azureazure-cli

I need to assure that all our resource groups have a specific tag.

I know I can use a policy to ensure that any created resource will have the tag, but for existing resources I'm trying to come up with a query using AZ CLI.

As an extra challenge, the tag has a space in the middle of its name: it is "Cost Center" instead of "CostCenter". :-/

Best Answer

I would recommend using Azure Resource Graph for this. Resource graph allows you to query all your Azure resources using the Kusto language either in the CLI or in the portal.

To look for the name of all resource groups that do not have the "Cost Center" tag you could run a query like:

ResourceContainers 
| project name, type, tags 
| where type == 'microsoft.resources/subscriptions/resourcegroups' 
| where tags !contains 'Cost Center' 
| project name

From the CLI this query would look like:

az graph query -q "ResourceContainers | project name, type, tags | where type == 'microsoft.resources/subscriptions/resourcegroups' | where tags !contains 'Cost Center' | project name"

Related Solutions

Azure RecoveryServiceVault can’t be removed

Finally was able to remove the vault, after clearing the sql backups from it through powershell. I'm really surprised NO ONE knew about this and it took so much digging to find it.

commands for anyone else having this problem:

These commands are to first see if anything is in the database backups, then remove it all.

$vault = Get-AzureRmRecoveryServicesVault -Name "VaultName"

Set-AzureRmRecoveryServicesVaultContext -Vault $vault

VIEW THE BACKUP ITEMS

$container = Get-AzureRmRecoveryServicesBackupContainer -ContainerType AzureSQL -FriendlyName $vault.Name

$item = Get-AzureRmRecoveryServicesBackupItem -Container $container -WorkloadType AzureSQLDatabase

$availableBackups = Get-AzureRmRecoveryServicesBackupRecoveryPoint -Item $item

$availableBackups

REMOVE THE BACKUP ITEMS AND VAULT

$containers = Get-AzureRmRecoveryServicesBackupContainer -ContainerType AzureSQL -FriendlyName $vault.Name

ForEach ($container in $containers)
{
    $items = Get-AzureRmRecoveryServicesBackupItem -container $container -WorkloadType AzureSQLDatabase

    ForEach ($item in $items)
    {
        Disable-AzureRmRecoveryServicesBackupProtection -item $item -RemoveRecoveryPoints -ea SilentlyContinue
    }

    Unregister-AzureRmRecoveryServicesBackupContainer -Container $container
}

Remove-AzureRmRecoveryServicesVault -Vault $vault

I hope I helped some other people out there who ran into this mess.

Azure resources using a specific subnet

There's not an easy way to achieve this using the REST API. You would have to get a list of all virtual machines, then get their NICs to list the subnets they are attached to and then categorize using that.

The other option is to use Azure Resource Graph to query your resources. The query below will get you the count of resources whos first NIC is in each subnet:

az graph query -q "where type =~ 'Microsoft.Network/networkInterfaces'  | extend subnet = properties.ipConfigurations[0].properties.subnet | summarize count() by tostring(subnet)

This assumes you run this using the CLI, but in theory it is possible to use resource graph using the REST API - see here

Best Answer

Related Solutions

Azure RecoveryServiceVault can’t be removed

Azure resources using a specific subnet

Related Topic