Hacker News Reader

I don't know much about Terraform, but at least in Pulumi you can mark resources as protected to prevent accidentally deleting them.

View on HN

https://learn.hashicorp.com/tutorials/terraform/resource-lif...

You can do it both in Terraform and also at the resource level in Azure itself.

That's chock full of bugs unfortunately. For example, if you lock an Azure DNS Zone to prevent it being deleted, you then cannot delete any DNS record under it! It's a strict hierarchy, there's no way to turn off the inheritance.

(It is possible to create a custom RBAC role that excludes zone deletion only, but this is very fiddly and not-quite-the-same in complex ways.)

Reply on news.ycombinator.com