Edit

Create a resource lock for Azure Cosmos DB Cassandra API keyspace and table using Azure CLI

  • Article

APPLIES TO: Cassandra

The script in this article demonstrates preventing resources from being deleted with resource locks.

Important

To create resource locks, you must have membership in the owner role in the subscription.

Resource locks do not work for changes made by users connecting using any Cassandra SDK, CQL Shell, or the Azure Portal unless the Azure Cosmos DB account is first locked with the disableKeyBasedMetadataWriteAccess property enabled. To learn more about how to enable this property see, Preventing changes from SDKs.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

  • This article requires Azure CLI version 2.12.1 or later. Run az --version to find the version. If you need to install or upgrade, see Install Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

Sample script

Launch Azure Cloud Shell

The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.

To open the Cloud Shell, just select Try it from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to https://shell.azure.com.

When Cloud Shell opens, verify that Bash is selected for your environment. Subsequent sessions will use Azure CLI in a Bash environment, Select Copy to copy the blocks of code, paste it into the Cloud Shell, and press Enter to run it.

Sign in to Azure

Cloud Shell is automatically authenticated under the initial account signed-in with. Use the following script to sign in using a different subscription, replacing <Subscription ID> with your Azure Subscription ID. If you don't have an Azure subscription, create an Azure free account before you begin.

subscription="<subscriptionId>" # add subscription here

az account set -s $subscription # ...or use 'az login'

For more information, see set active subscription or log in interactively

Run the script

# Resource lock operations for a Cassandra keyspace and table

# Subscription owner permissions required for this script

# Run this script after running
# "https://docs.microsoft.com/azure/cosmos-db/scripts/cli/cassandra/create#sample-script"

# Variable block
# Use values from prerequisite script or from your environment
# resourceGroup="your resource group name"
# account="your account name"
# keySpace="your keyspace name"
# table="your table name"

lockType="CanNotDelete" # CanNotDelete or ReadOnly
keySpaceParent="databaseAccounts/$account"
tableParent="databaseAccounts/$account/cassandraKeyspaces/$keySpace"
keySpaceLock="$keySpace-Lock"
tableLock="$table-Lock"

# Create a delete lock on keyspace
echo "Creating lock $lockType on $keySpaceLock"
az lock create --name $keySpaceLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/cassandraKeyspaces --lock-type $lockType --parent $keySpaceParent --resource $keySpace

# Create a delete lock on table
echo "Creating $lockType lock on $table"
az lock create --name $tableLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/tables --lock-type $lockType --parent $tableParent --resource $table

# List all locks on a Cosmos account
echo "Listing locks on $account"
az lock list --resource-group $resourceGroup --resource-name $account --namespace Microsoft.DocumentDB --resource-type databaseAccounts

# Delete lock on keyspace
echo "Deleting $keySpaceLock on $keySpace"
lockid=$(az lock show --name $keySpaceLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/cassandraKeyspaces --resource $keySpace --parent $keySpaceParent --output tsv --query id)
az lock delete --ids $lockid

# Delete lock on table
echo "Deleting $tableLock on $table"
lockid=$(az lock show --name $tableLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/tables --resource-name $table --parent $tableParent --output tsv --query id)
az lock delete --ids $lockid

Clean up resources

Use the following command to remove the resource group and all resources associated with it using the az group delete command - unless you have an ongoing need for these resources. Some of these resources may take a while to create, as well as to delete.

az group delete --name $resourceGroup

Sample reference

This script uses the following commands. Each command in the table links to command specific documentation.

Command Notes
az lock create Creates a lock.
az lock list List lock information.
az lock show Show properties of a lock.
az lock delete Deletes a lock.

Next steps