Create a resource lock for Azure Cosmos DB Cassandra API keyspace and table using Azure CLI
APPLIES TO: Cassandra
The script in this article demonstrates preventing resources from being deleted with resource locks.
Important
To create resource locks, you must have membership in the owner role in the subscription.
Resource locks do not work for changes made by users connecting using any Cassandra SDK, CQL Shell, or the Azure Portal unless the Azure Cosmos DB account is first locked with the disableKeyBasedMetadataWriteAccess
property enabled. To learn more about how to enable this property see, Preventing changes from SDKs.
If you don't have an Azure trail subscription, create a trial subscription before you begin.
Prerequisites
You can use the local Azure CLI.
If you prefer, install the Azure CLI to run CLI reference commands.
Local Azure CLI, see how to install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
Sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.
When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.
Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.
This article requires Azure CLI version 2.12.1 or later. Run
az --version
to find the version. If you need to install or upgrade, see Install Azure CLI.Note
Before you can use Azure CLI in Microsoft Azure operated by 21Vianet, please run
az cloud set -n AzureChinaCloud
first to change the cloud environment. If you want to switch back to Azure Public Cloud, runaz cloud set -n AzureCloud
again.
Sample script
Sign in to Azure
Use the following script to sign in using a different subscription, replacing <Subscription ID>
with your Azure Subscription ID. If you don't have an Azure trail subscription, create a trial subscription before you begin.
az cloud set -n AzureChinaCloud
az login
subscription="<subscriptionId>" # add subscription here
az account set -s $subscription # ...or use 'az login'
For more information, see set active subscription or log in.
Run the script
# Resource lock operations for a Cassandra keyspace and table
# Subscription owner permissions required for this script
# Run this script after running
# "https://docs.azure.cn/cosmos-db/scripts/cli/cassandra/create#sample-script"
# Variable block
# Use values from prerequisite script or from your environment
# resourceGroup="your resource group name"
# account="your account name"
# keySpace="your keyspace name"
# table="your table name"
lockType="CanNotDelete" # CanNotDelete or ReadOnly
keySpaceParent="databaseAccounts/$account"
tableParent="databaseAccounts/$account/cassandraKeyspaces/$keySpace"
keySpaceLock="$keySpace-Lock"
tableLock="$table-Lock"
# Create a delete lock on keyspace
echo "Creating lock $lockType on $keySpaceLock"
az lock create --name $keySpaceLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/cassandraKeyspaces --lock-type $lockType --parent $keySpaceParent --resource $keySpace
# Create a delete lock on table
echo "Creating $lockType lock on $table"
az lock create --name $tableLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/tables --lock-type $lockType --parent $tableParent --resource $table
# List all locks on a Cosmos account
echo "Listing locks on $account"
az lock list --resource-group $resourceGroup --resource-name $account --namespace Microsoft.DocumentDB --resource-type databaseAccounts
# Delete lock on keyspace
echo "Deleting $keySpaceLock on $keySpace"
lockid=$(az lock show --name $keySpaceLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/cassandraKeyspaces --resource $keySpace --parent $keySpaceParent --output tsv --query id)
az lock delete --ids $lockid
# Delete lock on table
echo "Deleting $tableLock on $table"
lockid=$(az lock show --name $tableLock --resource-group $resourceGroup --resource-type Microsoft.DocumentDB/tables --resource-name $table --parent $tableParent --output tsv --query id)
az lock delete --ids $lockid
Clean up resources
Use the following command to remove the resource group and all resources associated with it using the az group delete command - unless you have an ongoing need for these resources. Some of these resources may take a while to create, as well as to delete.
az group delete --name $resourceGroup
Sample reference
This script uses the following commands. Each command in the table links to command specific documentation.
Command | Notes |
---|---|
az lock create | Creates a lock. |
az lock list | List lock information. |
az lock show | Show properties of a lock. |
az lock delete | Deletes a lock. |