Feat: Add Resource Locking to ALZ Bicep Modules

[DaFitRobsta]

Overview/Summary

Adds the support for resource locking in all modules for resources that support resource locks.
See AB#30524 for additional details of feature request.
In response to #608

This PR fixes/adds/changes/removes

• Allows for setting resource locking globally or at each individual resource within the module.
• Resource locking at the subscription level is not supported in this release.

Breaking Changes

None

Testing Evidence

Each module that was updated to support Resource Locking was tested with successful deployments. Testing included setting the global parameter to different values as individual resources to validate resource locking logic.

As part of this Pull Request I have

• Read the Contribution Guide and ensured this PR is compliant with the guide
• Ensured the resource API versions in .bicep file/s I am adding/editing are using the latest API version possible
• Checked for duplicate Pull Requests
• Associated it with relevant GitHub Issues
• (ALZ Bicep Core Team Only) Associated it with relevant ADO Items
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated one or more of the following tests (if required)
  • Unit
  • Linting
  • E2E (End-To-End)
  • ValidateAzCloud (Base validation in Azure Cloud)
  • ValidateMcCloud (Base validation in Azure China Cloud)
• Updated relevant and associated documentation (e.g. Contribution Guide, Module READMEs, Wiki Docs etc.)
• If relevant, created or updated Code Tours here

[oZakari]

Thanks @DaFitRobsta! Will go through this PR later this week. 👍🏼

[oZakari]

Hey @DaFitRobsta, for the resource group module I see there is a new module called resourceGroupLock.bicep. Can we instead just use the resource lock provider as you have done for the other modules instead?

[DaFitRobsta]

Hey @DaFitRobsta, for the resource group module I see there is a new module called resourceGroupLock.bicep. Can we instead just use the resource lock provider as you have done for the other modules instead?

Hey @oZakari,
Because the resource group module has a targetScope set to the subscription level, if placing the resource lock within the module, it locks the subscription and not the resource group. I used this site, https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=bicep#template, as an example to work around the issue. It's my understanding that I have to call a sub-module in order to set the resource lock at the resource group level. If you have other methods to execute this without the extra module, please let me know.

[oZakari]

Hey @DaFitRobsta, for the resource group module I see there is a new module called resourceGroupLock.bicep. Can we instead just use the resource lock provider as you have done for the other modules instead?

Hey @oZakari, Because the resource group module has a targetScope set to the subscription level, if placing the resource lock within the module, it locks the subscription and not the resource group. I used this site, https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=bicep#template, as an example to work around the issue. It's my understanding that I have to call a sub-module in order to set the resource lock at the resource group level. If you have other methods to execute this without the extra module, please let me know.

Ah, that makes perfect sense. Thanks for the clarification on that!

[oZakari]

/azp run validateazcloud

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[oZakari]

Hey @DaFitRobsta, the ValidateAzCloud pipeline failed due to parPublicIPLock not being declared within the hub networking module. Could you add that in when you get chance please.

After adding the fix, you can run put /azp run validateazcloud in a comment to re-trigger the pipeline.

[DaFitRobsta]

/azp run validateazcloud

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).