az chaos
Note
This reference is part of the chaos extension for the Azure CLI (version 2.75.0 or higher). The extension will automatically install the first time you run an az chaos command. Learn more about extensions.
Manage Azure Chaos Studio resources.
Create and manage Chaos Studio v2 workspaces, scenarios, scenario configurations, and runs for chaos engineering experiments.
Commands
| Name | Description | Type | Status |
|---|---|---|---|
| az chaos discovered-resource |
Browse discovered resources in a Chaos Studio workspace. |
Extension | Preview |
| az chaos discovered-resource list |
List a list of discovered resources for a workspace. |
Extension | Preview |
| az chaos discovered-resource show |
Get a discovered resource. |
Extension | Preview |
| az chaos scenario |
Manage Chaos Studio scenarios within a workspace. |
Extension | Preview |
| az chaos scenario config |
Manage scenario configurations for a Chaos Studio scenario. |
Extension | Preview |
| az chaos scenario config create |
Create a scenario definition. |
Extension | Preview |
| az chaos scenario config delete |
Delete a scenario definition. |
Extension | Preview |
| az chaos scenario config execute |
Execute the scenario execution with the given scenario configuration. |
Extension | Preview |
| az chaos scenario config fix-permissions |
Fix RBAC permissions for a scenario configuration. |
Extension | Preview |
| az chaos scenario config list |
List a list of scenario definitions. |
Extension | Preview |
| az chaos scenario config show |
Get a scenario definition. |
Extension | Preview |
| az chaos scenario config show-permission-fix |
Get the latest permission-fix result for a scenario configuration. |
Extension | Preview |
| az chaos scenario config show-validation |
Get the latest validation result for a scenario configuration. |
Extension | Preview |
| az chaos scenario config update |
Update a scenario definition. |
Extension | Preview |
| az chaos scenario config validate |
Validate a scenario configuration. |
Extension | Preview |
| az chaos scenario config wait |
Place the CLI in a waiting state until a condition is met. |
Extension | Preview |
| az chaos scenario create |
Create a scenario. |
Extension | Preview |
| az chaos scenario delete |
Delete a scenario. |
Extension | Preview |
| az chaos scenario list |
List a list of scenarios. |
Extension | Preview |
| az chaos scenario run |
Manage scenario runs for a Chaos Studio scenario. |
Extension | Preview |
| az chaos scenario run cancel |
Cancel a running scenario run. |
Extension | Preview |
| az chaos scenario run list |
List a list of scenario runs. |
Extension | Preview |
| az chaos scenario run show |
Get a scenario run. |
Extension | Preview |
| az chaos scenario run start |
Start a scenario run from a scenario configuration. |
Extension | Preview |
| az chaos scenario run wait |
Place the CLI in a waiting state until a condition is met. |
Extension | Preview |
| az chaos scenario show |
Get a scenario. |
Extension | Preview |
| az chaos scenario update |
Update a scenario. |
Extension | Preview |
| az chaos setup |
Stand up a ready-to-use Chaos Studio environment in one step. |
Extension | GA |
| az chaos workspace |
Manage Chaos Studio workspaces. |
Extension | GA |
| az chaos workspace create |
Create a Workspace resource. |
Extension | Preview |
| az chaos workspace delete |
Delete a Workspace resource. |
Extension | Preview |
| az chaos workspace evaluate-scenarios |
Refreshes recommendation status for all scenarios in a given workspace. |
Extension | Preview |
| az chaos workspace identity |
Manage Identity. |
Extension | Preview |
| az chaos workspace identity assign |
Assign the user or system managed identities. |
Extension | Preview |
| az chaos workspace identity remove |
Remove the user or system managed identities. |
Extension | Preview |
| az chaos workspace identity show |
Show the details of managed identities. |
Extension | Preview |
| az chaos workspace identity wait |
Place the CLI in a waiting state until a condition is met. |
Extension | Preview |
| az chaos workspace list |
List a list of all Workspace resources in a subscription. |
Extension | Preview |
| az chaos workspace refresh-recommendation |
Refreshes recommendation status for all scenarios in a given workspace. |
Extension | Preview |
| az chaos workspace show |
Get a Workspace resource. |
Extension | Preview |
| az chaos workspace show-discovery |
Get the latest resource-discovery result for a workspace. |
Extension | GA |
| az chaos workspace show-evaluation |
Get the latest scenario-evaluation result for a workspace. |
Extension | GA |
| az chaos workspace update |
Update a Workspace resource. |
Extension | Preview |
| az chaos workspace wait |
Place the CLI in a waiting state until a condition is met. |
Extension | GA |
az chaos setup
Stand up a ready-to-use Chaos Studio environment in one step.
First-day-experience command that orchestrates the full bootstrap workflow so you do not have to run the individual commands yourself:
- Creates the resource group if it does not already exist. If the group already exists it is reused, and '--location' is optional (it defaults to the group's location). If the group does not exist, '--location' is required because setup creates the group and has no region to default to.
- Creates the workspace with a managed identity (user-assigned if '--user-assigned' is supplied, otherwise a system-assigned identity).
- Grants that identity the built-in 'Reader' role on each '--scopes' target (skip with '--skip-permissions') — discovery and evaluation run under the workspace identity and cannot enumerate resources without it. Re-assigning an existing role is a no-op.
- Evaluates scenarios for the workspace (resource discovery + scenario recommendations). When a NEW Reader assignment was just made, the evaluation is retried for a few minutes to absorb Azure Resource Graph propagation lag; pass '--skip-evaluation-wait' to run a single attempt (e.g. in CI) and get a rerun hint instead of waiting.
- Prints the discovered scenarios and the commands to run next.
This is a composite "porcelain" command: it wraps the granular 'workspace create', 'workspace refresh-recommendation', and role-assignment operations behind a single workflow verb. For fine-grained control, run those commands directly.
WHY '--scopes' IS REQUIRED: A workspace must declare which resources Chaos Studio is allowed to target — there is no safe default. You are expected to already have a resource group or service group (or a subscription) you plan to run experiments against. Pass one or more ARM resource IDs as the scope. The Azure portal's Create Workspace blade requires the same explicit choice.
ARM RESOURCE ID FORMATS (for '--scopes'):
Resource group (most common scope):
/subscriptions/<sub-id>/resourceGroups/<rg-name>
Subscription:
/subscriptions/<sub-id>
Service group:
/providers/Microsoft.Management/serviceGroups/<service-group-name>
ARM RESOURCE ID FORMAT (for '--user-assigned'):
User-assigned managed identity:
/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name>
Tip: copy a resource group's ID with
az group show -n <rg> --query id -o tsv.
az chaos setup --name
--resource-group
--scopes
[--acquire-policy-token]
[--change-reference]
[--location]
[--mi-user-assigned --user-assigned]
[--skip-evaluation-wait]
[--skip-permissions]
[--tags]Examples
Bootstrap a workspace scoped to a resource group, using a system-assigned identity
az chaos setup --name MyWorkspace --resource-group MyRG --location westus2 --scopes "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyRG"Bootstrap with a user-assigned identity as the workspace identity
az chaos setup --name MyWorkspace --resource-group MyRG --location westus2 --scopes "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyRG" --user-assigned "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MyIdentity"Bootstrap a workspace scoped to a service group
az chaos setup --name MyWorkspace --resource-group MyRG --location westus2 --scopes "/providers/Microsoft.Management/serviceGroups/my-critical-services"Bootstrap scoped to multiple resource groups and manage RBAC yourself
az chaos setup --name MyWorkspace --resource-group MyRG --location westus2 --scopes "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/AppRG" "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/DataRG" --skip-permissionsRequired Parameters
Name of the Chaos Studio workspace to create.
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
Space-separated list of ARM resource IDs that the workspace is allowed to target: a resource group, subscription, or service group. Required — there is no default scope. Examples: /subscriptions/<sub-id>/resourceGroups/<rg-name> or /providers/Microsoft.Management/serviceGroups/<name>.
Optional Parameters
The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.
Acquiring an Azure Policy token automatically for this resource operation.
| Property | Value |
|---|---|
| Parameter group: | Global Policy Arguments |
The related change reference ID for this resource operation.
| Property | Value |
|---|---|
| Parameter group: | Global Policy Arguments |
Location for the workspace. Optional only when the resource group already exists (defaults to the resource group's location). Required when the resource group does not exist, because setup creates it and has no region to default to.
Space-separated ARM resource ID(s) of user-assigned managed identities to use as the workspace identity. When omitted, the workspace uses a system-assigned identity. Example: /subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name>.
Do not wait/retry for Azure Resource Graph propagation after a new Reader role assignment; run a single evaluation attempt and report a rerun hint if it has not propagated yet. Useful for non-interactive/CI runs.
| Property | Value |
|---|---|
| Default value: | False |
Skip granting the workspace identity the Reader role on the target scopes. Use when you manage RBAC out of band. Evaluation still runs, but can only discover resources if the identity already holds Reader on the scopes.
| Property | Value |
|---|---|
| Default value: | False |
Space-separated tags in KEY=VALUE form for the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
| Property | Value |
|---|---|
| Default value: | False |
Show this help message and exit.
Only show errors, suppressing warnings.
| Property | Value |
|---|---|
| Default value: | False |
Output format.
| Property | Value |
|---|---|
| Default value: | json |
| Accepted values: | json, jsonc, none, table, tsv, yaml, yamlc |
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
| Property | Value |
|---|---|
| Default value: | False |
