Azure Recovery Vault Geo-Redundant Downgrade
1
1
low
What does ZopNight detect here?
Recovery Services vaults on GeoRedundant or ReadAccessGeoZoneRedundant storage with a positive non-production signal are candidates for LocallyRedundant replication. Savings require both GRS and LRS rates in the pricing cache; because Azure Backup pricing currently collapses to 1 vault key, those rates are absent and the rule abstains on live data.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1393 |
| Category | rightsizing |
| Severity | low |
| Metric | none — pure configuration read |
| Source | recovery_vault_downgrade.go |
Where it applies
Vaults on geo-redundant storage without prod signals
- resource.Metadata.storage_replication_type, written by the discoverer from the Azure Backup BackupResourceStorageConfigsNonCRR control-plane response. Missing key is fail-safe (the discoverer omits it on the “Invalid” sentinel or transient SDK errors); the rule must not fire without an authoritative value.
- Replication type ∈ {GeoRedundant, ReadAccessGeoZoneRedundant}. Anything else (already LRS, zone-redundant only, etc.) is skipped.
- Non-prod signal: either a dev/test name pattern (isDevTestName) OR a subscriptionIsNonprod=true Metadata flag from the subscription enricher (read via hasTagValue(resource.Metadata, …)).
- Prod-veto signal: any prod name pattern OR prod env tag (isProdResource) overrides the non-prod signal. Gates 3 and 4 are asymmetric on purpose: name patterns carry false-positive risk in both directions, so the rule requires an affirmative non-prod signal AND the absence of any prod signal.
- Optional cross_region_restore_enabled=true Metadata flag (read via hasTagValue(resource.Metadata, …)) adds a CRR-disable prerequisite line to the description and remediation.
Why the GRS to LRS rate delta is unavailable
when both recovery-vault-grs and recovery-vault-lrs rates are present in pricing_cache for the vault's region, savings is the real rate delta via DeriveCatalogDiffSavingsStrict(srcRate, dstRate, cost); when either rate is absent or the delta is non-positive the rule ABSTAINS (returns nil) -- the prior 0.40 storage-haircut fallback was removed (T0223: Azure Backup pricing collapses every meter into one lowest-rate-wins recovery-vault key, so the grs/lrs keys are never produced today and the rule abstains on live data until that pricing split lands).Switching replication to LocallyRedundant
(from manualsteps.go):
- Confirm this Recovery Services vault backs only non-production workloads and a second-region copy is not a business requirement.
- Recovery Services vault → {{.ResourceName}} → Properties → Backup Configuration.
- If cross-region restore is enabled, disable it first, because Azure blocks the replication change while CRR is on.
- Change Storage replication type to LocallyRedundant (LRS).
- Azure applies the change only while the vault holds no protected items. If items exist, stop protection with retain-data first, switch replication, then restore protection.
- Save the configuration and verify the new replication type on the Properties blade.
No metrics, metadata and environment only
None (signal is metadata + env-classification)