Since 3.10.2, this module has claimed that the Kladde comes out of an empty subscription with nothing but a pipeline, Bicep and a runbook. Every lesson has built a piece of it and proved it. Only one thing shows whether the whole holds: tear everything down and build it again. In this lesson you do exactly that, measure how long it takes, and write down every manual step that is not in the runbook. Each such step is a finding. You’re done when a run has none left.
What is this good for outside a course? A subscription can be lost: it’s compromised and has to be abandoned, the billing account changes, a region is down for a long time and the Kladde has to run in another one. Whoever has never rehearsed the rebuild finds out at that moment what only ever existed by hand.
What a teardown leaves behind
A teardown doesn’t delete everything. Azure keeps some things on purpose, and some things don’t live in the subscription at all. Both affect the rebuild:
| What | After the teardown | Consequence for the rebuild |
|---|---|---|
| Resource groups and everything in them | deleted | created again |
| Budget, policies, roles at subscription level | deleted along with the foundation stack | created again |
| Key Vault with purge protection (3.3.2) | soft-deleted for 90 days; the name stays reserved worldwide and can’t be released early | recover it before the platform tries to create it; the signing key comes back with it, the role assignments don’t |
| Log Analytics workspace | soft-deleted for 14 days | if the platform creates it again with the same name in the same resource group and region, it’s back with its data |
| Azure SQL server | deleted, with all databases and their backups | the database comes back empty; more on that in a moment |
| Storage account | deleted | raw data and offers are gone |
| Images in the registry | deleted with rg-kladde-shared |
the pipeline builds them again |
| Entra: the group “Kladde-Operations”, the sign-in’s app registration | stay, because they belong to the tenant, not the subscription | their redirect URIs and federated credentials point to things that no longer exist |
| Entra: memberships of the deleted identities | gone, with the identities | the new identities have new object IDs and have to be added again |
| GitHub: environments, variables, workflows, history | stay | the variables name old client IDs until the runbook sets them again |
The Kladde has already prepared for two rows of this table. You switched on the vault’s purge protection in 3.3.2, and lesson 3.6.5
announced that it would catch you here. And the runbook scripts/foundation.ps1 from 3.10.2 sets the variables in GitHub again on every
run. During the rebuild it simply runs once more.