How is resource deletion handled by Bicep?

[idrisscharai]

Hi all! 👋🏼

Apologies if this has been discussed previously, I just couldn't find the answers I am looking for.

We are currently using Azure DevOps with Azure Cloud for our project, and decided to go with Bicep for our IaC. My only major worry currently is the fact that resource deletion apparently happens differently than in, let's say, Terraform or CloudFormation.

If we deploy resources A, B, and C with an initial template and decide later on to remove resource C using the template, simply commenting it out or removing it then redeploying does not result in the resource actually being deleted in the environment.

From my understanding, the templates "manage" the resources written within it, but as soon as they're removed from it, they're ignored.
I know about the different deployment modes, where Incremental (default) is only concerned about the template's resources and Complete is aware of the "other" resource that weren't deployed by the template itself.

I tried two scenarios where I deploy then try to remove a Container Registry using the template, but neither modes succeeded and just ignore it.

Is there a different way of removing specific resources from the template AND the cloud via the deployments as opposed to manually?

Thank you so much in advance! 🌷

[StefanIvemo]

You need to use the Complete deployment mode to remove resources. It will remove resources not declared in the template.

If I deploy a template that looks like this to create a container registry:

resource containerRegistry 'Microsoft.ContainerRegistry/registries@2021-06-01-preview' = {
  name: 'mynewacrsteffe'
  location: 'westeurope'
  sku: {
    name: 'Basic'
  }
  properties: {
    adminUserEnabled: false
  }
}

I can remove the container registry from Azure by removing the resource from the template or commenting it out like you mentioned and deploy the template again using Complete mode.

Deploying this template using New-AzResourceGroupDeployment -ResourceGroupName acr-rg -TemplateFile .\acr.bicep -Mode Complete would delete the container registry.

/*
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2021-06-01-preview' = {
  name: 'mynewacrsteffe'
  location: 'westeurope'
  sku: {
    name: 'Basic'
  }
  properties: {
    adminUserEnabled: false
  }
}
*/

[idrisscharai]

Thank you for your reply!

Is there any reason for the exact same process that you described not to work? Because I had tried before and it simply ignores the existing resources AND the resource commented out, with complete mode on.

Should I be using different commands?
Perhaps using az deployment group create is not the right command when trying to update/delete resources?

[brwilkinson]

Just be careful in your testing, anything inside of the deployment scope e.g. resource group, can be deleted/removed when doing a complete deployment, so ensure you are aware of the risk for loss of data.

[aagashe-attekus]

What do I do if I want to delete the resources created by the Bicep template itself? I am looking for an equivalent command to

terraform destroy --auto-approve

[slavizh]

@aagashe-attekus use deployment stacks https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks?tabs=azure-powershell there are commands to delete the whole deployment stack and the resources within it.

[aagashe-attekus]

Sadly, it does not work for deployment of Management Groups, as we do not deploy management groups in a resource group, so what is the option for that?

[slavizh]

Log any requests here: https://github.com/Azure/deployment-stacks/issues. Management groups cannot be deployed at resource group as they are resource at higher scope than resource group. Overall if you refer to deletion for management group that is not so common operation but deleting resources that can be deployed at management group scope like policies and role assignments it is.