Microsoft.resources.subscriptions.resourcegroups.delete

​

Event Information

• The Microsoft.Resources.subscriptions.resourceGroups.delete event in Azure for Azure Resource Management indicates that a resource group has been deleted within an Azure subscription.
• This event signifies that all resources within the resource group, including virtual machines, storage accounts, and network resources, have been permanently removed.
• It is important to note that this event is irreversible, and all data and configurations associated with the deleted resource group will be lost. Therefore, it is crucial to ensure that the deletion is intended and that any necessary backups or data transfers have been performed beforehand.

​

Examples

1. Unauthorized deletion of resource groups: If security is impacted with Microsoft.Resources.subscriptions.resourceGroups.delete in Azure, it could potentially allow unauthorized users to delete resource groups. This could lead to the loss of critical resources and data, impacting the availability and integrity of the Azure environment.
2. Data exposure: If security is impacted, an attacker could potentially gain access to sensitive data stored within the resource groups before they are deleted. This could result in a data breach and compromise the confidentiality of the information stored in Azure.
3. Service disruption: If security is impacted, an attacker could potentially delete resource groups that are essential for the functioning of critical services or applications. This could lead to service disruptions, downtime, and financial losses for the organization.

​

Remediation

​

Using Console

1. Enable Azure Resource Manager diagnostic settings:
   • Go to the Azure portal and navigate to the resource group containing the resources you want to monitor.
   • Select the resource group and click on “Diagnostic settings” in the left-hand menu.
   • Click on “Add diagnostic setting” and provide a name for the diagnostic setting.
   • Select the desired resources and enable the required diagnostic logs.
   • Choose the destination for the logs, such as Azure Storage or Log Analytics.
   • Save the diagnostic setting.
2. Implement Azure Policy for resource management:
   • In the Azure portal, go to the Azure Policy service.
   • Click on “Definitions” in the left-hand menu and search for the desired policy definition.
   • Select the policy definition and click on “Assign policy” to apply it.
   • Choose the scope for the policy assignment, such as a subscription or resource group.
   • Configure the parameters and conditions for the policy, if applicable.
   • Save the policy assignment.
3. Monitor and remediate non-compliant resources:
   • In the Azure portal, go to the Azure Policy service.
   • Click on “Compliance” in the left-hand menu to view the compliance status of resources.
   • Identify the non-compliant resources and click on them to view the details.
   • Take necessary actions to remediate the non-compliance, such as modifying resource configurations or deleting resources.
   • Verify the compliance status after remediation.

​

Using CLI

1. Identify the specific issue or misconfiguration in AzureResourceManagement.
2. Use the Azure CLI to execute the appropriate commands to remediate the issue.

az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <resource-id> --logs '[{"category": "AuditEvent", "enabled": true}]'

az policy assignment create --name <policy-assignment-name> --scope <resource-id> --policy <policy-definition-id>

az security secure-score control update --name <control-name> --resource-id <resource-id> --status "enabled"

​

Using Python

1. Identify the specific issue or misconfiguration in AzureResourceManagement.
2. Use the Azure SDK for Python (azure-mgmt-resource package) to interact with Azure Resource Manager and perform the necessary remediation tasks.
3. Write Python scripts to automate the remediation process based on the specific issue. Here are three examples:

from azure.mgmt.monitor import MonitorManagementClient
from azure.identity import DefaultAzureCredential

# Authenticate using DefaultAzureCredential
credential = DefaultAzureCredential()

# Create a MonitorManagementClient
monitor_client = MonitorManagementClient(credential, subscription_id)

# Enable diagnostic settings for a specific resource
monitor_client.diagnostic_settings.create_or_update(
    resource_uri,
    diagnostic_settings_name,
    {
        "logs": [
            {
                "category": "AuditEvent",
                "enabled": True
            }
        ]
    }
)

from azure.mgmt.resource import PolicyClient
from azure.identity import DefaultAzureCredential

# Authenticate using DefaultAzureCredential
credential = DefaultAzureCredential()

# Create a PolicyClient
policy_client = PolicyClient(credential, subscription_id)

# Enable Azure Policy for a specific resource
policy_client.assign_resource_policy(
    policy_assignment_name,
    {
        "policy_definition_id": policy_definition_id,
        "scope": resource_uri
    }
)

from azure.mgmt.security import SecurityCenter
from azure.identity import DefaultAzureCredential

# Authenticate using DefaultAzureCredential
credential = DefaultAzureCredential()

# Create a SecurityCenter client
security_center_client = SecurityCenter(credential, subscription_id)

# Enable Azure Security Center recommendations for a specific resource
security_center_client.security_solutions.update(
    resource_group_name,
    security_solution_name,
    {
        "properties": {
            "isEnabled": True
        }
    }
)