Azure / Azure/deployment-stacks
Deployment Stack - Resource deletion order
- Dominant language
- Bicep
- Stars
- 101
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
**Bicep version**
Bicep CLI version 0.28.1 (ba1e9f8c1e)
**Describe the bug**
Running a command like `Remove-AzSubscriptionDeploymentStack -Name 'imageStack' -DeleteAll -Verbose -Force` for a Deployment Stack of the same name seems not to consider certain contraints when it comes to the order of resource deletion.
In the given case I'm deploying (amongst other things) a User-Assigned Identity + an Image Template to which the same is attached. When removing these resources again, it is vital that the User-Assigned Identity is removed **after** the Image Template as the same otherwise ends up in a non-removable state. This looks like this:

In the terminal you get a stuck command (which does not respond to cancelation keys like `Ctrl + C`) like
```powershell
> Remove-AzSubscriptionDeploymentStack -Name 'imageStack' -DeleteAll -Verbose -Force
VERBOSE: Performing the operation "Deleting Deployment Stack ..." on target "imageStack".
```
This is just one example of many and the reason why we implemented a very specific removal order & logic in the [AVM CI](https://github.com/Azure/bicep-registry-modules/blob/6bfef3b5819d4a8c750f41e0b0d76c2943f6afd1/avm/utilities/pipelines/e2eValidation/resourceRemoval/Initialize-DeploymentRemoval.ps1#L73-L102).
Naturally, I do not know how Deployment Stacks handle removals in the background as suspect it just runs a removal on the Resource Group or similar. Regardless, the logic may need to be update to be more granular (and ideally also handle purge protection, etc.). Happy to talk through some of the things we identified in CARML & AVM over the years and logic we implementated for the same.
Until these issues are not addressed we won't be able to replace our current removal logic with Deployment Stacks.
**To Reproduce**
Steps to reproduce the behavior:
It should be enough to deploy the MSI + Image Template (alongside any required resource) - OR - if you want to test with the full example, deploy [this template](https://github.com/AlexanderSehr/DevOps-Self-Hosted/blob/users/alsehr/avm/constructs/azureImageBuilder/deploymentFiles/sbx.image.bicep) with updated parameters for unique resources like the ACR & StorageAccount, and using the command `New-AzSubscriptionDeploymentStack -Name 'imageStack' -Description 'This is a first test deployment using Deployment Stacks' -Location 'WestEurope' -TemplateFile '(...)\constructs\azureImageBuilder\deploymentFiles\sbx.image.bicep' -Verbose -TemplateParameterObject @{ deploymentsToPerform = 'All' } -DenySettingsMode 'None'`, followed by the eventual removal command.
**Additional context**
PS: Fundamentally a very cool feature though (:
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.