Resource Graph

Introduction

Azure Resource Graph is a service for querying Azure resources at scale using a structured query language. It helps you search, filter, and project resource metadata across subscriptions. Resource Graph is useful for inventory, governance checks, and automated analysis workflows.

LocalStack for Azure allows you to build and test Resource Graph workflows in your local environment. The supported APIs are available on our API Coverage section, which provides information on the extent of Resource Graph’s integration with LocalStack.

Getting started

This guide is designed for users new to Resource Graph and assumes basic knowledge of the Azure CLI and our azlocal wrapper script.

Start your LocalStack container using your preferred method. Then start CLI interception:

azlocal start_interception

Create a resource group

Create a resource group for the resources you want to query:

az group create \
  --name rg-resourcegraph-demo \
  --location westeurope

Output

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-resourcegraph-demo",
  "location": "westeurope",
  "managedBy": null,
  "name": "rg-resourcegraph-demo",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

Create sample web resources

Create an App Service plan and a Web App, which we will query using Resource Graph:

az appservice plan create \
  --name asp-doc81 \
  --resource-group rg-resourcegraph-demo \
  --location westeurope \
  --sku F1

az webapp create \
  --name ls-app-doc81 \
  --resource-group rg-resourcegraph-demo \
  --plan asp-doc81 \
  --runtime "PYTHON:3.11"

Output

{
  "asyncScalingEnabled": false,
  "elasticScaleEnabled": false,
  "geoRegion": "West Europe",
  "hyperV": false,
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-resourcegraph-demo/providers/Microsoft.Web/serverfarms/asp-doc81",
  ...
  "name": "asp-doc81",
  ...
  "status": "Ready",
  "subscription": "00000000-0000-0000-0000-000000000000",
  ...
}
{
  ...
  "enabledHostNames": [
    "ls-app-doc81.azurewebsites.net",
    "ls-app-doc81.scm.azurewebsites.net"
  ],
  ...
  "hostNameSslStates": [
    {
      "hostType": "Standard",
      "name": "ls-app-doc81.azurewebsites.net",
      "sslState": "Disabled",
      "thumbprint": null,
      "toUpdate": null,
      "virtualIp": null
    },
    ...
  ],
  "hostNames": [
    "ls-app-doc81.azurewebsites.net"
  ],
  ...
}

Query resources with Resource Graph

The following queries mirror the same patterns used in our validated tests:

• filter by type: where type =~ 'Microsoft.Web/sites'
• filter by type and name: where type =~ 'Microsoft.Web/sites' and name =~ 'ls-app-doc81'
• filter by name: where name =~ 'ls-app-doc81'
• project only IDs: where type =~ 'Microsoft.Web/sites' and name =~ 'ls-app-doc81' | project id

For example, run a query for all web sites:

az rest --method post \
  --url "http://management.localhost.localstack.cloud:4566/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01" \
  --headers "Content-Type=application/json" \
  --body "{\"subscriptions\":[\"00000000-0000-0000-0000-000000000000\"],\"query\":\"where type =~ 'Microsoft.Web/sites'\"}"

Output

{
  "count": 1,
  "data": {
    "columns": [
      {
        "name": "id",
        "type": "string"
      },
      {
        "name": "name",
        "type": "string"
      },
      ...
    ],
    "rows": [
      [
        "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-resourcegraph-demo/providers/Microsoft.Web/sites/ls-app-doc81",
        "ls-app-doc81",
        "westeurope",
        ...
      ]
    ]
  },
  ...
  "totalRecords": 1
}

Or, run a query for an unknown resource name:

az rest --method post \
  --url "http://management.localhost.localstack.cloud:4566/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01" \
  --headers "Content-Type=application/json" \
  --body "{\"subscriptions\":[\"00000000-0000-0000-0000-000000000000\"],\"query\":\"where type =~ 'Microsoft.Web/sites' and name =~ 'doesnotexist'\"}"

Output

{
  "count": 0,
  "facets": [],
  "resultTruncated": "false",
  "totalRecords": 0
}

API Coverage

Operation ▲	Implemented ▼

PreviousPage 1 of 0Next