Azure-cli: az lock create does not allow to set resource locks for VNet subnets

[fawohlsc]

az feedback auto-generates most of the information requested below, as of CLI version

2.0.81

Describe the bug
az lock create does not allow to set resource locks for VNet subnets. The following error is shown:

validation error: Parameter 'resource_provider_namespace' can not be None.

To Reproduce
See this screenshot below - basically setting a resource lock on a VNet works, but setting a resource lock in one of it's VNet subnets results in an error:

Expected behavior
Locking a VNet subnet should be supported.

Environment summary
Azure Cloud Shell (Bash) with Azure CLI 2.0.81 installed

Additional context
Not sure if resource locking a VNet subnet is supported by Azure in general.

[yonzhan]

add to S167.

[fawohlsc]

@yonzhan Many thanks. I assume S167 is sprint 167. What are your spring lengths and what is the current sprint? Many thanks :-)

[yonzhan]

https://github.com/Azure/azure-cli/milestones three weeks cadence.

[zhoxing-ms]

@fawohlsc Hi, if you want to lock subnets, the service needs to know which virtualNetworks the subnets belong to.
There are two correct command formats:

1. az lock create --name {lock-name} --lock-type ReadOnly --resource-group {resource-group} --resource-type Microsoft.Network/virtualNetworks --resource {virtualNetwork-name}/subnets/{subnet-name}
2. az lock create --name {lock-name} --lock-type ReadOnly --resource-group {resource-group} --resource-type Microsoft.Network/subnets --parent virtualNetworks/{virtualNetwork-name} --resource {subnet-name} (more recommended)

[zhoxing-ms]

@fawohlsc However, I found that there is no entry on portal to support locking subnets granular resources, please help to confirm whether this function is reasonable and needed?
If so, please contact members of the portal team to add the ability to lock subnets granular resources. And I will supplement this example in the CLI help documentation.

[fawohlsc]

@zhoxing-ms first of all many thanks for your insightful response and proactivity to add this to the documentation. Great job! 🥇

Many customers want to empower their developers to create or change VNet subnets, i.e. all auto-scalable resources in Azure usually require a dedicated subnet (i.e. VMSS, AAG, APIM, ...). But some of the subnets contain shared resources or resources managed by central IT (i.e. AAG with PIP requires delete lock) - here we require a lock for the subnets. Following I think we should add this feature to the portal as well. Can you point me to their repository? Was not able to find it... Many thanks in advance!

[msftbot[bot]]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @armleads-azure.

[msftbot[bot]]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @aznetsuppgithub.

[msftbot[bot]]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @aznetsuppgithub.

[allegradomel]

If this issue concerns only Portal side I will untag SDN

[fawohlsc]

@allegradomel issue works in Azure CLI but not documented. @zhoxing-ms opened a pull request to enhance documentation. Feature is unfortunately not available in Azure Portal.