The Azure governance is possible thanks to a series of specially designed services to enable a management and a constant control of the various Azure resources on a large scale. Among these services are Resource Graph, a powerful tool that allows you to quickly obtain via command-line details regarding the different Azure artifacts. Using Resource Graph you can retrieve information that previously required necessarily complex and iterative scripting. This article lists the characteristics of the solution and how you can use it to find out the details of Azure resources on large scale.
Characteristics of the service
In the presence of complex Azure environments who see the presence of many subscriptions, maintain overall visibility of all Azure resources can be complex without the use of tools specifically developed. These requirements which typically need to be addressed:
- Ability to view resources and their properties in a transversal way among different subscriptions.
- Be able to efficiently perform queries on resources by setting filters, groupings and by imposing a specific sort order on their properties.
- Explore iteratively the different resources.
- Assessing the impact achieved by applying policies on a large number of cloud resources.
The service Azure Resource Graph allows, thanks to the use of an efficient and powerful language to perform the following actions:
- Query on resources by applying filters, complex groupings and sorts.
- Explore iteratively resources based on the governance requirements.
- Assess the impact given by the application of the policy in a vast cloud.
- Detailing the changes that are made to the Azure resource properties. Recently was introduced the ability to view the last 14 days of history regarding the changes made to resources, to identify which properties have been changed and when. This feature is particularly useful in the process of troubleshooting, to detect any change events in a specific time slot. Furthermore, it is functional to understand the properties that were changed when a resource has changed the status of compliance, to consider adopting Azure Policy to properly manage such properties. For further details please visit the Microsoft's official documentation.
All these actions provide important aspects in order to govern the most of their Azure environment.
When an Azure resource is updated, Resource Graph Resource Manager is notified by the relevant changes and updates its database accordingly. Resource Graph also regularly performs a complete scan of resources to ensure that your information is up to date in case of missing notifications or updates that take place outside of Resource Manager.
How to use Resource Graph
The query of Azure Resource Graph are based on the Kusto language, also used by Azure Data Explorer, Application Insights and Azure Log Analytics. For more details on using the query language of Azure Resource Graph you can see the Microsoft's official documentation, that shows how it is structured and what are the operators and supported features.
Resource Graph supports theAzure CLI, Azure PowerShell and Azure SDK for .NET. Querying Resource Graph requires the addition of the relative extension in the Azure CLI environment , while in Azure PowerShell the installation of the Resource Graph module is required. The queries are always structured in an identical manner, regardless of where they are performed.
The use of Resource Graph requires that the user with which it performs the query has at least read permissions, through Role-based access control (RBAC), about resources that you intend to query. If you don't have at least read permission on specific resources, queries will not return results related to them.
The service Azure Resource Graph is also used when performing research in the search bar of the Azure portal, in the new list of resources (‘All resources’) and in the change history of Azure Policy.
Figure 1 – Experience of ‘All resources’ using Azure Resource Graph
Sample Query
Below are some examples of query of Resource Graph and its result.
Figure 2 - Query to count by resources type (Resource Type)
Figure 3 - Query to count the resources by geographic location
The query of Azure Resource Graph have the advantage that besides being able to achieve the desired result in a simple way, they are also very performant:
Figure 4 - Running time of the query to count the resources based on location
If anyone wanted to achieve this result using the classic PowerShell method in complex Azure environments, should join to the single Azure subscription, search the necessary information and move to the next subscription. This approach was the only possible until the arrival of Resource Graph, but it was more labor intensive and much less powerful.
Figure 5 - List of VMs with the OS disk not Managed
Conclusions
Azure Resource Graph allows you to quickly and efficiently explore and analyze Azure resources, allowing to maintain a total visibility even on particularly complex Azure environments, consisting of several subscriptions, each of which with a large number of elements. Particularly useful is the functionality that allows you to see the history of changes to Azure resources. Azure Resource Graph is a tool that allows you to make a significant contribution for the governance of the Azure environment.
