[Issue] azd down removes resource groups not created by azd

[tvriesde]

• Make sure you've installed the latest version using instructions in the wiki

Output from azd version
Run azd version and copy and paste the output here:
azd version 1.4.3 (commit d165bd2)

Describe the bug
Description of issue you're seeing...
azd down seems to delete resources by deleting entire resource groups.

For resource groups created by azd up, this works, but if your bicep also contains resource creation in an existing rg, then this could lead to unwanted removal of resources.

A solution to prevent unwanted removals, is to lock the existing rg, but then azd down failes.

To Reproduce
Scenario 1:

1. create "existing" rg with vnet
2. create azd project which creates a new rg and creates a subnet in the existing rg
3. azd down

Scenario 2:

1. create "existing" rg with vnet
2. add lock to rg
3. create azd project which creates a new rg and creates a subnet in the existing rg
4. azd down

This issue was customer reported, I reproduced with the following azd project: https://github.com/tvriesde/azdstarter

Expected behavior
azd down should not remove entire resource groups which already existed before azd up. Instead it should only remove resources part of the azd up deployment.

[krbar]

Facing a similar issue.
Scenario:

• an infrastructure package, created with Bicep, deploys an Application Gateway, Public IP, User-Assigned Managed Identity and WAF Policy
• package references an existing Key Vault in a different Resource Group, which contains a secret required by the App Gateway
• during the deployment, we are performing an RBAC role deployment on the (existing) Key Vault, enabling the MSI of the Application Gateway to access the secret
• all above steps work fine and the App Gateway deploys without issues

Issue:
azd down not only removes the Resource Group deployed by the package, but also the resource group containing the Key Vault, which existed prior to the package deployment.

If necessary, I can provide a sample to reproduce the issue.

[obiwanjacobi]

Yep, same here. We have resource groups managed by a different division and we do not have the rights to delete it. So an option (flag) that leaves the rg but does delete the resources would be great.

[BartNetJS]

Any update on this issue?

[rrussell0]

Any updates on this?