有什么方法可以阻止 inheritance 從資源組到資源，並使用 python 對 Azure 的虛擬機磁盤應用只讀鎖？

Question

使用下面的 python 代碼，我可以鎖定一個資源組，並且它的資源可以繼承鎖定。

有沒有什么辦法可以停止 inheritance 對資源和對虛擬機磁盤應用只讀鎖？

Answer 1

沒有用於停止 create_or_update_at_resource_group_level() 的 inheritance 的選項。

雖然鎖可以應用於單個資源級別： https://github.com/Azure/azure-sdk-for-python/blob/release/v3/sdk/resources/azure-mgmt-resource/azure/mgmt/resource/ locks/v2016_09_01/operations/_management_locks_operations.py#L430

Answer 2

如果要對虛擬機磁盤創建鎖，請參考以下示例

1. 為一個磁盤創建鎖

compute_client=get_client_from_cli_profile(ComputeManagementClient)
lock_client = get_client_from_cli_profile(ManagementLockClient)

disk = compute_client.disks.get(resource_group_name='testLinux', disk_name='testLinux_OsDisk_1_41c3d0e2e7b74dcca653b4e058a9332f')
lock_client.management_locks.create_or_update_by_scope(scope=disk.id,lock_name='DeleteLock',parameters={'level' : LockLevel.can_not_delete})

2. 在一個訂閱中為所有磁盤創建鎖

from azure.common.client_factory import get_client_from_cli_profile
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.resource import ManagementLockClient
from azure.mgmt.resource.locks.models import LockLevel

compute_client=get_client_from_cli_profile(ComputeManagementClient)
lock_client = get_client_from_cli_profile(ManagementLockClient)

disks = compute_client.disks.list()

for disk in disks:
    lock_client.management_locks.create_or_update_by_scope(scope=disk.id,lock_name='DeleteLock',parameters={'level' : LockLevel.can_not_delete})

---

更新

如果要獲取azure vm鏈接資源，請參考以下代碼

from azure.common.client_factory import get_client_from_cli_profile
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.resource import ManagementLockClient, ResourceManagementClient
from azure.mgmt.resource.locks.models import LockLevel

compute_client=get_client_from_cli_profile(ComputeManagementClient)
lock_client = get_client_from_cli_profile(ManagementLockClient)
resource_client = get_client_from_cli_profile(ResourceManagementClient)

resource_group_name='jimtest'
vm=compute_client.virtual_machines.get(resource_group_name=resource_group_name,vm_name='testvm')
# get os disk
os_disk=compute_client.disks.get(resource_group_name=resource_group_name,disk_name=vm.storage_profile.os_disk.name)
print("the vm os disk id is : "+os_disk.id)

#get data disk
for disk in vm.storage_profile.data_disks:
    data_disk = compute_client.disks.get(resource_group_name=resource_group_name, disk_name=disk.name)
    print("the vm data disk id is : " + data_disk.id)

#get nic
for nic in vm.network_profile.network_interfaces:
     print("the vm networkInterface id: ", nic.id)
     # get public ip, subnet,vent,nsg
     vm_nic = resource_client.resources.get_by_id(nic.id, api_version='2018-12-01')
     #get nsg
     print("the vm nsg id is :" + vm_nic.properties['networkSecurityGroup']['id'])
     for ipConfiguration in vm_nic.properties['ipConfigurations']:
         #get public ip
         print("the vm public ip id is :" + ipConfiguration['properties']['publicIPAddress']['id'])
         #get subnet
         id = ipConfiguration['properties']['subnet']['id']
         print("the vm subnet id is : " + id)
         #get vnet
         end = id.rfind('/', 0, id.rfind('/'))
         print("the vm vnet id is : " + id[0:end])