Azure Automation – delete selected resource groups in a subscription

The aim of this blog is to demonstrate how to automate the scheduled deletion of resource groups across your sandbox / development subscriptions as part of your FinOps practice, in an effort to manage your cloud sprawl as well as manage your security vulnerabilities.

Deployment Plan

In the blog we will be deploying;

Deployment Steps

Step 1 – Automation Account

Provision your Azure Automation Account.

Step 2 – System Assigned Managed identity

Enable your SAMI,

Step 3 – RBAC Role

Assign the SAMI to the target scope as a Contributor,

Step 4 – Runbook

Create a new PowerShell runbook

##Azure Automation Account - delete all resource groups in a subscription (with exclusions)


#STEP 1 - LOGIN
#Authenticate with the System Account Managed Identity (SAMI)
#Ensure that you have enabled the SAMI on your automation account and assigned the RBAC role to the target subscription scope.
Connect-AzAccount -Identity


#STEP 2 - SET SUBSCRIPTION FOCUS
Set-AzContext -Subscription "5cf7052e-0000-0000-0000-000000000000" #Sandbox Environment


# STEP 3 - CREATE THE RESOURCE GROUP EXCLUSION LIST
$excludedResourceGroups = `
@("allen-actiongroup", "allen-AI-keyvault", "allen-sandbox-storageaccount", "Devops-Terraform", "NetworkWatcherRG", "rg-devops-terraform", "allen-automation")  # Add the names of resource groups to exclude


# STEP 4- GET ALL RESOURCE GROUPS IN THE TARGET SUBSCRIPTION
$allResourceGroups = Get-AzResourceGroup

# Loop through each resource group and delete it if not in the exclusion list
foreach ($rg in $allResourceGroups) {
    if ($excludedResourceGroups -notcontains $rg.ResourceGroupName) {
        Write-Host "Deleting resource group: $($rg.ResourceGroupName)"
        Remove-AzResourceGroup -Name $rg.ResourceGroupName -Force
    }
}

Step 5 – PowerShell script

Paste your PowerShell script into the run book,

Save,

Test pane > Start,

Verification

Below shows the 7 resource groups which were added to the exclusion list remaining after the automation account runbook has executed, while all the other (2) resource groups have been deleted.

Publish your runbook once you have confirmed that it works as expected,

Step 6 – Schedule

Create a schedule and attach to the runbook.

—I hope this blog demonstrated the deployment of your Automation Runbook on how to quickly and easily clean up your sandbox / development enviroments as part of your FinOps practice —