Access Public Airlock Storage Accounts through Application Gateway

[tamirkamara]

Description

As a TRE Researcher,
I want to upload/download airlock files through application gateway,
So that URLs used will be the "TRE" ones.

As an administrator / security officer,
I want to reduce the number of exposed endpoints in the solution.

Acceptance criteria

• Uploads are done through appgw with existing tools (az cli, storage explorer, etc.)
• Downloads are done through appgw with existing tools (az cli, storage explorer, etc.)
• The application (UI and/or API) is able to provide those "external" links correctly
• If everything works, public access to airlock's external storage accounts need to be blocked

[jonnyry]

@tamirkamara been thinking about this one.

Would you put the import and export storage accounts on non-root URL paths - e.g. /airlock-import & /airlock-export? (or would you add seperate dedicated domains for the import and export)

Do you know whether Storage Explorer & az cli would work if not connecting on a root path?

[tamirkamara]

@jonnyry I didn't think that far :-)
But maybe those could be just the container guid.
I also found this at the time: https://blog.zuehlke.cloud/2022/12/storage-account-as-backend-service-for-application-gateways/

[marrobi]

#4853 would help enable this as is a single public storage account. Not sure az cli would work, but uploads with curl do.