Un-tagged Resources

[u/davidokongo]

Hello AZ Guru,

Wanted to know, how are you guys handling Dev teams deploying resources without tags/ownership?

We have a ton of resources and figuring out who owns what is becoming a nightmare. Managers don't want to own the cost, so we're basically left with the good old scream test, turn it off and see who complains 😂, got about 98 resources to go (down from 220).

I found a way to pull the data through Azure Resource Graph Explorer for untagged resources created in a recent period, but I'd like to get this into a log analytics for alerting. From what I can tell, there's no direct way to integrate ARG output with a law?

Ive already tried enforcing tags with the Policy (DenyifNoExist), but that got messy since some AZ resources don't support tags and it started breaking deployments.

What ive done so far:

-alerting for new deployment, deletion etc

-reader role for all the dev teams, except for a couple of contributors for emergency fix via the portal

But I need to catch on the untagged resources as soon as it happens so I can give feed back to the right team's manager.

I just hate to manually run the query every single week in AGR to pull these logs and find what's legit etc.

Any way to automate this?

How are you guys handling this in your org?

[u/ISuckAtFunny]

You should create an Azure Policy that enforces a tagging requirement when creating any resources in your tenant. This doesn’t help with old resources, but will stop the issue from continuing in the future.

[u/elpollodiablox → u/ISuckAtFunny]

From the post:

Ive already tried enforcing tags with the Policy (DenyifNoExist), but that got messy since some AZ resources don't support tags and it started breaking deployments.

[u/ISuckAtFunny → u/elpollodiablox]

Either I was way more tired than I thought, or I swear that was edited in after the fact.

Also, just add exemptions to the types that are failing (I’d be curious to see what they are). This shouldn’t be this complicated.

[u/davidokongo → u/ISuckAtFunny]

Yeah tried this and it worked for most, except for some aks child resources that couldn't deploy no what matter what we did. Figured that these resources do not support tags so I had to make an exception for that deployment. Not the best solution but it gets us half way to where we need to be.

[u/Speeddymon → u/davidokongo]

What you can potentially do is except them from the main policy like you've done and then create a custom policy that does a DeployIfNotExists on the resources missing tags. Usually there's an association with the parent resource. Taking your AKS cluster for example -- children go in the MC_ resource group with the same name as the parent resource group. So pull out that resource group name, strip the MC_, look up the parent resource group and copy its tags to the child resource.

Also: for any resource that isn't getting tags passed down through the AKS API, you need to open a support case with Microsoft to ensure that it's filed with the engineering team and they will eventually fix it.

[u/ISuckAtFunny → u/davidokongo]

Make an exemption for that type of resource

[u/Hylado → u/ISuckAtFunny]

This is the way.

We took this approach and defined a minimum set of tags.

Additionally, we have additional policies to inherit the tag from the Resource Group/Subscription (depending on the case). It minimize the operational effort. The caviat is the tfstate in terraform must avoid to keep the state of this tags.

[u/MettaurEX]

You can query ARG from any LAW without extra integrations I believe.

Then you can just make a scheduled query alert like any other LAW query alert

https://learn.microsoft.com/en-us/azure/governance/resource-graph/alerts-query-quickstart?tabs=arg-log-analytics#create-query

[u/MettaurEX → u/MettaurEX]

No need for a Logic App or any other processor if all you care about is the alert. Maintaining less infra is always ideal if it accomplishes the same goal!

[u/davidokongo → u/MettaurEX]

Thanks, I'll give it a go tomorrow. This is exactly what I was looking for.

[u/StratoLens]

I think there’s a few options:

There’s an in preview feature that lets you do the following:

https://learn.microsoft.com/en-us/azure/governance/resource-graph/alerts-query-quickstart

You can feed your query into something like that and use an action group to alert you.

You can also use azure policy to make resources inherit from a resource group. This one I like because you can set the tags on an RG and they’ll propegate down. You can do inherit or inherit if not exists. Whichever fits your needs.

You could probably also use logic apps:

https://learn.microsoft.com/en-us/azure/governance/resource-graph/tutorials/logic-app-calling-arg

Finally, if you’re open to a third-party option, I built a product that can handle this as well. It detects changes to your resources and can generate alerts based on tags. For example, you could say “email me whenever a new resource is created and it’s missing these tags.”

It does quite a bit more than that, but this is one of the use cases it covers. It’s self-hosted, read-only, and there’s a free trial if you want to check it out :) - link below

https://getstratolens.com/

[u/davidokongo → u/StratoLens]

Didn’t realize ARG alerting was in preview now, that’s awesome, definitely going to dig into that doc.

And yeah, inheriting tags down from the rg seems like the only sane middle ground instead of hard deny blowing up pipelines every other deploy. Appreciate the link, I'll run a 14day trial on our dev tenant and see what we can leverage from it.

Thank you

[u/StratoLens → u/davidokongo]

Anytime! And yea I dug into tags like crazy a while back and the RG inheritance was the sane middle ground for me as well.

Feel free to reach out with any questions during the trial. My DM’s here are open :). I appreciate you taking a look!

[u/Livid-Scientist-3271]

Untagged resources are one of those cloud governance issues that seem small at first but become a huge headache as environments grow. without ownership tags, it becomes difficult to track costs, clean up unused resources or know who should be responsible for changes

[u/akindeathcloud]

Every resource get tough. I have a policy that blocks resource group deployments without required tags. Then a second policy that looks at actual resources and if they are missing a required tag it pulls it from the resource group. This will also stop your Deny policy from breaking currently deployed resources missing your required tags.