Get Azure resource group creation time

Question

Intent: Know when a resource group was created for the first time. The client organization wants to report and act on resource group creation timestamps. This will be used in automation scripts.

Unfortunately there is no creation timestamp property on resource groups. Using Get-AzureRmResourceGroup returns objects like this:

ResourceGroupName : eastus2-something-rg
Location          : eastus2
ProvisioningState : Succeeded
Tags              :
ResourceId        : /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/eastus2-something-rg

This feature has been requested, but doesn't appear to have many votes.

How do I retrieve the creation timestamp for a resource group?

Answer 1

Indeed, resource groups don't have a creation timestamp.

But management operations are recorded in logs, and these logs can be retrieved with the Get-AzureRmLog command.

Here is a PowerShell statement that goes through a subscription's resource groups and finds those that were created n or more days ago (from this gist):

$days = 7
$pointInTime = [DateTime]::Now.AddDays(-$days);
$horizon = $pointInTime.AddDays(-$days);

"===Removing resource groups created between $horizon and $pointInTime==="

# Get potential log entries
$logs = @()
$logs += Get-AzureRmLog -StartTime $horizon -EndTime $pointInTime -Status "Succeeded" -ResourceProvider "Microsoft.Resources" -WarningAction "SilentlyContinue" `
    | Select-Object ResourceGroupName, ResourceId, @{Name="EventNameValue"; Expression={$_.EventName.Value}}, @{Name="OperationNameValue"; Expression={$_.OperationName.Value}}, EventTimestamp, @{Name="HttpVerb"; Expression={$_.HttpRequest.Method}} `
    | Where-Object -FilterScript {$_.EventNameValue -EQ "EndRequest" -and $_.OperationNameValue -eq "Microsoft.Resources/subscriptions/resourcegroups/write" -and $_.HttpVerb -eq "PUT"} `
    | Select-Object -ExpandProperty ResourceGroupName -Unique

"Expired resource groups (created BEFORE $pointInTime) -> $logs"

# Get recent log entries to remove from the list
$nologs = @()
$nologs += Get-AzureRmLog -StartTime $pointInTime -Status "Succeeded" -ResourceProvider "Microsoft.Resources" -WarningAction "SilentlyContinue" `
| Select-Object ResourceGroupName, ResourceId, @{Name="EventNameValue"; Expression={$_.EventName.Value}}, @{Name="OperationNameValue"; Expression={$_.OperationName.Value}}, EventTimestamp, @{Name="HttpVerb"; Expression={$_.HttpRequest.Method}} `
| Where-Object -FilterScript {$_.EventNameValue -EQ "EndRequest" -and $_.OperationNameValue -eq "Microsoft.Resources/subscriptions/resourcegroups/write" -and $_.HttpVerb -eq "PUT"} `
| Select-Object -ExpandProperty ResourceGroupName -Unique

"Resource groups created AFTER $pointInTime -> $nologs"

# remove any that were found to have recent creation
$rgs = $logs | Where-Object {$nologs -notcontains $_} | Select-Object @{Name="ResourceGroupName"; Expression={$_}} | Get-AzureRmResourceGroup -ErrorAction "SilentlyContinue"

"Existing resource groups to delete -> $($rgs | Select-Object -ExpandProperty ResourceGroupName)"

$rgs | Remove-AzureRmResourceGroup -Force -AsJob

It returns a list of the jobs that are running to delete the resource groups (they can take some time depending on their contents).

Answer 2

This information is available via ARM, but you have to call the API directly rather than the PS Get-AzureRmResourceGroup (or Get-AzResourceGroup) cmdlets.

See Deleting all resources in an Azure Resource Group with age more than x days

Essentially, you need to add the to the $expand=createdTime to your query parameters, ie.:

GET https://management.azure.com/subscriptions/1237f4d2-3dce-4b96-ad95-677f764e7123/resourcegroups?api-version=2019-08-01&%24expand=createdTime