You know what it's like - you're working on some IaC and spinning up loads of different resources at once, or you've been playing around with ideas and now you're left with a raft of bits and pieces to clean up to save yourself some money, but going into the portal and finding them all can be a hassle, and writing loads of Azure CLI delete statements is a pain. If only there was a tool that offered a single CLI command you could run to delete a bunch of selected stuff at once. Well, now there is. - welcome to Beeching.
Beeching is a command line tool to help you quickly and easily delete Azure resources you no longer need. Inspired by The Beeching Axe it allows you to cull vast numbers of resources across a subscription with a single swing of the axe. It can delete multiple resource types at the same time, based on a name, part of a name, or by tag value.
Resources can be protected from the axe by specifying them in an exclusion list. This allows you to shield resources that you wish to keep. The list of resources can be further restricted to only cull certain types of resource by using another switch.
Locked resources? No problem, Beeching can cull those too, as long as you have the permission of course.
Beeching is a cross-platform .NET 6.0 / 7.0 application that can be run on Windows, Linux and Mac. It can be installed via any terminal, or in the Cloud Shell, and can also be run in your CI/CD pipeline.
You can install the tool globally, using the dotnet tool command:
dotnet tool install --global beeching
When a new version is available you will be prompted when calling Beeching, and you can use the dotnet tool update command to easily upgrade your installation:
dotnet tool update --global beeching
To call to beeching and swing the axe, you need to run the command from a user account with permissions to delete the specified resources, and resource locks if using the --force option. Authentication is performed via Azure CLI. Make sure to run az login (optionally with the --tenant parameter) to make sure you have an active session and have the correct subscription selected by using the az account set command. Alternatively you can specify a different subscription when calling the tool.
You can invoke the axe using the beeching command and by specifying your parameters. The most basic usage is to specify the name of the resources you want to axe. This will use your active Azure CLI subscription and will delete all resources that match the name or part of the name. You can use the axe command, but this is optional as it is the default command so can be omitted.
beeching axe --name my-resource
This is the same as:
beeching --name my-resource
Multiple name values can be supplied in a single string by separating them with the : symbol as in this example.
beeching --name my-resource-001:my-resource-002
Resources can also be selected by tags. This will delete all resources that have a tag with the specified key and value. Tags must be supplied as a single string in the format key:value.
beeching --tag key:value
Excluding and restricting
Once you have selected the resources you want to axe, you can optionally specify a list of resources to exclude from the axe using the --exclude option. This allows you to protect resources you wish to keep.
beeching --name my-resource --exclude my-resource-to-keep
Multiple name values can again be supplied in a single string by separating them with the : symbol.
beeching --name my-resource --exclude keep001:keep002
The list of resources can be further restricted to only cull certain types of resource using the --resource-types option. This example will only axe resources of the type Microsoft.Storage/storageAccounts.
beeching --name my-resource --resource-types Microsoft.Storage/storageAccounts
Again multiple options can be specified by single string separating them with a : symbol, as shown in this example which will axe only storage accounts and virtual networks.
beeching --name my-resource --resource-types Microsoft.Storage/storageAccounts:Microsoft.Network/virtualNetworks
Resource Groups
By default the axe will only cull individual resource types. If you want to axe an entire resource group and all the resources within it, you can use the --resource-group option. This will axe the resource group and all resources in it. This option can be used with the --name or --tag options to axe resource group that match the name, or partial name, or tag key and value.
beeching --name my-resource-group --resource-group
All of these options can be combined to create a very specific axe that will only delete the resources you want to delete.
Resource Locks
Resource locks can be applied to Azure resources at the resource, resource group or subscription level. If a resource is locked, it cannot be axed. Beeching will check for resource locks and will not attempt to axe any resources that are locked. If you want to axe a resource that is locked, you will need to remove all applicable locks first, or use the --force option to override the locks.
beeching --name my-resource --force
Using the --force option will attempt to remove any resource locks before axing the resource. This can be useful if you have a resource that is locked, but you know that it is safe to delete. This option should be used with caution as it can lead to accidental deletion of resources.
Following the axing of a locked resource, any relevant locks, such as subscription locks or resource group locks will be reapplied. This is to prevent accidental deletion of resources that are locked for a reason.
What If?
It is also possible to use the --what-if parameter to see which resources would face the axe. This will show you the list of resources that would be deleted, but will not actually delete anything.
beeching --name my-resource --what-if
Confirmation
Before any resources are actually deleted, you will be prompted to confirm that you really want to delete the resources. For automated deletion such as in a CI/CD pipeline you can skip this prompt by using the --yes parameter.
beeching --name my-resource --yes
Retries
A built-in retry mechanism is in place to handle transient network errors. By default, the axe will retry each request 3 times at the API level.
Occasionally deletion requests can fail if other dependent resources have yet to be deleted. In this instance a further retry mechanism is in place which will pause for 10 seconds between each retry attempt, and each action will be retried 6 times. These two values are configurable and can be set using the --max-retry and --retry-pause parameters.
beeching --name my-resource --max-retry 10 --retry-pause 30
Top comments (2)
Great job! I tried to apply the tool to delete a purview collection TEST_COL with the following parameters:
--collection isn't a valid option for the tool. You need to specify either a resource name or tags. These are used to identify whatever resources that can be matched, of any type. Not sure what the error you got is, I'd need to look into it, but if you can tag the resources and use the --tag command line switch that should work. That said I've never worked with Purview collections so would need to look at them to see what's going on.