Enhancements to airlock functions

.vscode/settings.json

@@ -1,9 +1,12 @@
 {
   "cSpell.words": [
     "aadcdn",
+    "Adls",
     "ADWS",
     "autologon",
     "azkms",
+    "azureblob",
+    "azuredatafactory",
     "azureedge",
     "azureportal",
     "azuresynapse",
@@ -21,6 +24,7 @@
     "privatelink",
     "rdweb",
     "reactblade",
+    "resourcegroups",
     "sovereignprodimedatahotfix",
     "sovereignprodimedatapri",
     "sovereignprodimedatasec",

research-hub/deploy.ps1

@@ -87,7 +87,7 @@ $DeploymentResults = New-AzDeployment @CmdLetParameters
 if ($DeploymentResults.ProvisioningState -eq 'Succeeded') {
     Write-Host "🔥 Deployment successful!"
 
-    $DeploymentResult.Outputs | Format-Table -Property Key, @{Name = 'Value'; Expression = { $_.Value.Value } }
+    $DeploymentResults.Outputs | Format-Table -Property Key, @{Name = 'Value'; Expression = { $_.Value.Value } }
 }
 else {
     $DeploymentResults

research-hub/main.bicep

@@ -379,6 +379,7 @@ module diskEncryptionSetModule '../shared-modules/security/diskEncryptionSet.bic
     name: replace(resourceNamingStructureNoSub, '{rtype}', 'des')
     kvRoleDefinitionId: rolesModule.outputs.roles.KeyVaultCryptoServiceEncryptionUser
   }
+  dependsOn: [uamiKvRbacModule]
 }
 
 /*

research-spoke/main.bicep

@@ -114,6 +114,8 @@ param adminEntraIdObjectId string
 param isAirlockReviewCentralized bool = false
 @description('The email address of the reviewer for this project.')
 param airlockApproverEmail string
+@description('The email address where process notifications (designed to be the principal investigator) will be sent.')
+param airlockProcessNotificationEmail string
 @description('The allowed file extensions for ingest.')
 param allowedIngestFileExtensions array = []
 
@@ -485,7 +487,6 @@ var storageAccountReaderRoleAssignmentForResearcherGroup = {
   description: 'Read access to the storage account is required to use Azure Storage Explorer.'
 }
 
-
 // Deploy the project's private storage account
 module storageModule './spoke-modules/storage/main.bicep' = {
   name: take(replace(deploymentNameStructure, '{rtype}', 'storage'), 64)
@@ -670,7 +671,7 @@ module airlockModule './spoke-modules/airlock/main.bicep' = {
     airlockFileShareName: isAirlockReviewCentralized ? centralAirlockFileShareName : fileShareNames.exportReview
 
     approverEmail: airlockApproverEmail
-    
+
     // TODO: Refactor
     honestBrokerEntraObjectId: honestBrokerEntraIdObjectId
     honestBrokerRoleDefinitionId: rolesModule.outputs.roles.StorageFileDataSMBShareReader
@@ -731,6 +732,8 @@ module airlockModule './spoke-modules/airlock/main.bicep' = {
     usePrivateEndpoints: usePrivateEndpoints
 
     allowedIngestFileExtensions: allowedIngestFileExtensions
+
+    processNotificationEmail: airlockProcessNotificationEmail
   }
 }
 

research-spoke/spoke-modules/airlock/adf.bicep

@@ -22,10 +22,15 @@ param encryptionKeyVaultUri string
 
 param adfEncryptionKeyName string
 
+// TODO: Use pipelineNamesType
 param pipelineNameAdls2Files string = 'pipe-data_move-adls_to_files'
 param pipelineNameFilesToAdls string = 'pipe-data_move-files_to_adls'
+param pipelineNameFilesToFiles string = 'pipe-data_move-files_to_files'
+
 param debugMode bool
 
+import { pipelineNamesType } from '../../../shared-modules/types/pipelineNamesType.bicep'
+
 var baseName = !empty(subWorkloadName)
   ? replace(namingStructure, '{subWorkloadName}', subWorkloadName)
   : replace(namingStructure, '-{subWorkloadName}', '')
@@ -380,7 +385,7 @@ resource dfsDataset 'Microsoft.DataFactory/factories/datasets@2018-06-01' = {
   }
 }
 
-resource pipeline 'Microsoft.DataFactory/factories/pipelines@2018-06-01' = {
+resource pipelineAdls2Files 'Microsoft.DataFactory/factories/pipelines@2018-06-01' = {
   name: pipelineNameAdls2Files
   parent: adf
   properties: {
@@ -451,6 +456,46 @@ resource pipelineFilesToAdls 'Microsoft.DataFactory/factories/pipelines@2018-06-
   ]
 }
 
+resource pipelineFilesToFiles 'Microsoft.DataFactory/factories/pipelines@2018-06-01' = {
+  name: pipelineNameFilesToFiles
+  parent: adf
+  properties: {
+    activities: loadJsonContent('./content/adfPipeline-Files2Files.json')
+    parameters: {
+      sinkConnStringKvBaseUrl: {
+        type: 'String'
+      }
+      sinkFileShareName: {
+        type: 'String'
+      }
+      sourceStorageAccountName: {
+        type: 'String'
+      }
+      sinkStorageAccountName: {
+        type: 'String'
+      }
+      sourceFolderPath: {
+        type: 'String'
+      }
+      sinkFolderPath: {
+        type: 'String'
+      }
+      fileName: {
+        type: 'String'
+      }
+      sourceFileShareName: {
+        type: 'String'
+      }
+      sourceConnStringKvBaseUrl: {
+        type: 'String'
+      }
+    }
+  }
+  dependsOn: [
+    AzFilesDataset
+  ]
+}
+
 // LATER: Abstract to storage-RoleAssignment module
 var storageAccountRoleDefinitionId = roles.StorageBlobDataContributor
 
@@ -468,6 +513,9 @@ resource adfPrivateStgRole 'Microsoft.Authorization/roleAssignments@2022-04-01'
 
 output principalId string = adf.identity.principalId
 output name string = adf.name
-// LATER: Rename output pipeline name
-output pipelineName string = pipelineNameAdls2Files
-output pipelineNameFilesToAdls string = pipelineNameFilesToAdls
+
+output pipelineNames pipelineNamesType = {
+  blobToFileShare: pipelineNameAdls2Files
+  fileShareToBlob: pipelineNameFilesToAdls
+  fileShareToFileShare: pipelineNameFilesToFiles
+}

research-spoke/spoke-modules/airlock/content/adfPipeline-Files2Files.json

@@ -0,0 +1,91 @@
+[
+  {
+    "name": "Move data",
+    "type": "Copy",
+    "dependsOn": [],
+    "policy": {
+      "timeout": "0.12:00:00",
+      "retry": 0,
+      "retryIntervalInSeconds": 30,
+      "secureOutput": false,
+      "secureInput": false
+    },
+    "userProperties": [],
+    "typeProperties": {
+      "source": {
+        "type": "BinarySource",
+        "storeSettings": {
+          "type": "AzureFileStorageReadSettings",
+          "recursive": true,
+          "deleteFilesAfterCompletion": true
+        },
+        "formatSettings": {
+          "type": "BinaryReadSettings"
+        }
+      },
+      "sink": {
+        "type": "BinarySink",
+        "storeSettings": {
+          "type": "AzureFileStorageWriteSettings"
+        }
+      },
+      "enableStaging": false
+    },
+    "inputs": [
+      {
+        "referenceName": "AzFilesDataset",
+        "type": "DatasetReference",
+        "parameters": {
+          "fileName": {
+            "value": "@pipeline().parameters.fileName",
+            "type": "Expression"
+          },
+          "storageAccountName": {
+            "value": "@pipeline().parameters.sourceStorageAccountName",
+            "type": "Expression"
+          },
+          "folderPath": {
+            "value": "@pipeline().parameters.sourceFolderPath",
+            "type": "Expression"
+          },
+          "fileShareName": {
+            "value": "@pipeline().parameters.sourceFileShareName",
+            "type": "Expression"
+          },
+          "connStringKvBaseUrl": {
+            "value": "@pipeline().parameters.sourceConnStringKvBaseUrl",
+            "type": "Expression"
+          }
+        }
+      }
+    ],
+    "outputs": [
+      {
+        "referenceName": "AzFilesDataset",
+        "type": "DatasetReference",
+        "parameters": {
+          "fileName": {
+            "value": "@pipeline().parameters.fileName",
+            "type": "Expression"
+          },
+          "storageAccountName": {
+            "value": "@pipeline().parameters.sinkStorageAccountName",
+            "type": "Expression"
+          },
+          "folderPath": {
+            "value": "@pipeline().parameters.sinkFolderPath",
+            "type": "Expression"
+          },
+          "fileShareName": {
+            "value": "@pipeline().parameters.sinkFileShareName",
+            "type": "Expression"
+          },
+          "connStringKvBaseUrl": {
+            "value": "@pipeline().parameters.sinkConnStringKvBaseUrl",
+            "type": "Expression"
+          }
+        }
+      }
+    ]
+  }
+]