Skip to content

Commit 5c23102

Browse files
JimMadgeJimMadge
committed
Add NFSV3StorageAccount component
1 parent ab5e710 commit 5c23102

4 files changed

Lines changed: 12 additions & 77 deletions

File tree

‎data_safe_haven/infrastructure/components/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
SSLCertificateProps,
2020
)
2121
from .wrapped import (
22+
NFSV3StorageAccount,
2223
WrappedLogAnalyticsWorkspace,
2324
)
2425

@@ -34,6 +35,7 @@
3435
"LocalDnsRecordProps",
3536
"MicrosoftSQLDatabaseComponent",
3637
"MicrosoftSQLDatabaseProps",
38+
"NFSV3StorageAccount",
3739
"PostgresqlDatabaseComponent",
3840
"PostgresqlDatabaseProps",
3941
"SSLCertificate",

‎data_safe_haven/infrastructure/components/wrapped/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
from .log_analytics_workspace import WrappedLogAnalyticsWorkspace
2+
from .nfsv3_storage_account import NFSV3StorageAccount
23

34
__all__ = [
5+
"NFSV3StorageAccount",
46
"WrappedLogAnalyticsWorkspace",
57
]

‎data_safe_haven/infrastructure/programs/sre/data.py‎

Lines changed: 4 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from data_safe_haven.infrastructure.components import (
3232
BlobContainerAcl,
3333
BlobContainerAclProps,
34+
NFSV3StorageAccount,
3435
SSLCertificate,
3536
SSLCertificateProps,
3637
)
@@ -459,52 +460,16 @@ def __init__(
459460
# Deploy sensitive data blob storage account
460461
# - This holds the /data and /output containers that are mounted by workspaces
461462
# - Azure blobs have worse NFS support but can be accessed with Azure Storage Explorer
462-
storage_account_data_private_sensitive = storage.StorageAccount(
463+
storage_account_data_private_sensitive = NFSV3StorageAccount(
463464
f"{self._name}_storage_account_data_private_sensitive",
464465
# Storage account names have a maximum of 24 characters
465466
account_name=alphanumeric(
466467
f"{''.join(truncate_tokens(stack_name.split('-'), 11))}sensitivedata{sha256hash(self._name)}"
467468
)[:24],
468-
enable_https_traffic_only=True,
469-
enable_nfs_v3=True,
470-
encryption=storage.EncryptionArgs(
471-
key_source=storage.KeySource.MICROSOFT_STORAGE,
472-
services=storage.EncryptionServicesArgs(
473-
blob=storage.EncryptionServiceArgs(
474-
enabled=True, key_type=storage.KeyType.ACCOUNT
475-
),
476-
file=storage.EncryptionServiceArgs(
477-
enabled=True, key_type=storage.KeyType.ACCOUNT
478-
),
479-
),
480-
),
481-
kind=storage.Kind.BLOCK_BLOB_STORAGE,
482-
is_hns_enabled=True,
469+
allowed_ip_addresses=props.data_private_sensitive_ip_addresses,
483470
location=props.location,
484-
minimum_tls_version=storage.MinimumTlsVersion.TLS1_2,
485-
network_rule_set=storage.NetworkRuleSetArgs(
486-
bypass=storage.Bypass.AZURE_SERVICES,
487-
default_action=storage.DefaultAction.DENY,
488-
ip_rules=Output.from_input(
489-
props.data_private_sensitive_ip_addresses
490-
).apply(
491-
lambda ip_ranges: [
492-
storage.IPRuleArgs(
493-
action=storage.Action.ALLOW,
494-
i_p_address_or_range=str(ip_address),
495-
)
496-
for ip_range in sorted(ip_ranges)
497-
for ip_address in AzureIPv4Range.from_cidr(ip_range).all_ips()
498-
]
499-
),
500-
virtual_network_rules=[
501-
storage.VirtualNetworkRuleArgs(
502-
virtual_network_resource_id=props.subnet_data_private_id,
503-
)
504-
],
505-
),
471+
subnet_id=props.subnet_data_private_id,
506472
resource_group_name=props.resource_group_name,
507-
sku=storage.SkuArgs(name=storage.SkuName.PREMIUM_ZRS),
508473
opts=child_opts,
509474
tags=child_tags,
510475
)

‎data_safe_haven/infrastructure/programs/sre/desired_state.py‎

Lines changed: 4 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
storage,
1818
)
1919

20-
from data_safe_haven.external import AzureIPv4Range
2120
from data_safe_haven.functions import (
2221
alphanumeric,
2322
replace_separators,
@@ -32,6 +31,7 @@
3231
from data_safe_haven.infrastructure.components import (
3332
BlobContainerAcl,
3433
BlobContainerAclProps,
34+
NFSV3StorageAccount,
3535
)
3636
from data_safe_haven.resources import resources_path
3737
from data_safe_haven.types import AzureDnsZoneNames
@@ -84,49 +84,15 @@ def __init__(
8484
# Deploy desired state storage account
8585
# - This holds the /desired_state container that is mounted by workspaces
8686
# - Azure blobs have worse NFS support but can be accessed with Azure Storage Explorer
87-
storage_account = storage.StorageAccount(
87+
storage_account = NFSV3StorageAccount(
8888
f"{self._name}_storage_account",
89-
# Storage account names have a maximum of 24 characters
9089
account_name=alphanumeric(
9190
f"{''.join(truncate_tokens(stack_name.split('-'), 11))}desiredstate{sha256hash(self._name)}"
9291
)[:24],
93-
enable_https_traffic_only=True,
94-
enable_nfs_v3=True,
95-
encryption=storage.EncryptionArgs(
96-
key_source=storage.KeySource.MICROSOFT_STORAGE,
97-
services=storage.EncryptionServicesArgs(
98-
blob=storage.EncryptionServiceArgs(
99-
enabled=True, key_type=storage.KeyType.ACCOUNT
100-
),
101-
file=storage.EncryptionServiceArgs(
102-
enabled=True, key_type=storage.KeyType.ACCOUNT
103-
),
104-
),
105-
),
106-
kind=storage.Kind.BLOCK_BLOB_STORAGE,
107-
is_hns_enabled=True,
92+
allowed_ip_addresses=props.admin_ip_addresses,
10893
location=props.location,
109-
network_rule_set=storage.NetworkRuleSetArgs(
110-
bypass=storage.Bypass.AZURE_SERVICES,
111-
default_action=storage.DefaultAction.DENY,
112-
ip_rules=Output.from_input(props.admin_ip_addresses).apply(
113-
lambda ip_ranges: [
114-
storage.IPRuleArgs(
115-
action=storage.Action.ALLOW,
116-
i_p_address_or_range=str(ip_address),
117-
)
118-
for ip_range in sorted(ip_ranges)
119-
for ip_address in AzureIPv4Range.from_cidr(ip_range).all_ips()
120-
]
121-
),
122-
virtual_network_rules=[
123-
storage.VirtualNetworkRuleArgs(
124-
virtual_network_resource_id=props.subnet_desired_state_id,
125-
)
126-
],
127-
),
12894
resource_group_name=props.resource_group_name,
129-
sku=storage.SkuArgs(name=storage.SkuName.PREMIUM_ZRS),
95+
subnet_id=props.subnet_desired_state_id,
13096
opts=child_opts,
13197
tags=child_tags,
13298
)

0 commit comments

Comments
 (0)