[WIP] Adding an extra flag to config-SRE

alan-turing-institute · Nov 29, 2024 · 2daf019 · 2daf019
1 parent 60726e9
commit 2daf019
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 25 deletions.
diff --git a/data_safe_haven/config/config_sections.py b/data_safe_haven/config/config_sections.py
@@ -56,6 +56,7 @@ class ConfigSectionSRE(BaseModel, validate_assignment=True):
     # https://docs.pydantic.dev/latest/concepts/models/#fields-with-non-hashable-default-values
     admin_email_address: EmailAddress
     admin_ip_addresses: list[IpAddress] = []
+    allow_workspace_internet: bool = False
     databases: UniqueList[DatabaseSystem] = []
     data_provider_ip_addresses: list[IpAddress] | AzureServiceTag = []
     remote_desktop: ConfigSubsectionRemoteDesktopOpts

diff --git a/data_safe_haven/infrastructure/programs/sre/firewall.py b/data_safe_haven/infrastructure/programs/sre/firewall.py
@@ -108,6 +108,38 @@ def __init__(
             tags=child_tags,
         )
 
+        # TODO: Check how to better implement this.
+        # Add allow_workspace_internet boolean config.
+        if props.allow_workspace_internet:
+            workspace_deny_firewall_collection = network.AzureFirewallApplicationRuleCollectionArgs(
+                        action=network.AzureFirewallRCActionArgs(
+                            type=network.AzureFirewallRCActionType.DENY
+                        ),
+                        name="workspaces-deny",
+                        priority=FirewallPriorities.SRE_WORKSPACES_DENY,
+                        rules=[
+                            network.AzureFirewallApplicationRuleArgs(
+                                description="Deny external Ubuntu Snap Store upload and login access",
+                                name="DenyUbuntuSnapcraft",
+                                protocols=[
+                                    network.AzureFirewallApplicationRuleProtocolArgs(
+                                        port=int(Ports.HTTP),
+                                        protocol_type=network.AzureFirewallApplicationRuleProtocolType.HTTP,
+                                    ),
+                                    network.AzureFirewallApplicationRuleProtocolArgs(
+                                        port=int(Ports.HTTPS),
+                                        protocol_type=network.AzureFirewallApplicationRuleProtocolType.HTTPS,
+                                    ),
+                                ],
+                                source_addresses=props.subnet_workspaces_prefixes,
+                                target_fqdns=ForbiddenDomains.UBUNTU_SNAPCRAFT,
+                            ),
+                        ],
+                    )
+        else:
+            workspace_deny_firewall_collection = None
+
+
         # Deploy firewall
         firewall = network.AzureFirewall(
             f"{self._name}_firewall",
@@ -282,31 +314,7 @@ def __init__(
                         ),
                     ],
                 ),
-                network.AzureFirewallApplicationRuleCollectionArgs(
-                    action=network.AzureFirewallRCActionArgs(
-                        type=network.AzureFirewallRCActionType.DENY
-                    ),
-                    name="workspaces-deny",
-                    priority=FirewallPriorities.SRE_WORKSPACES_DENY,
-                    rules=[
-                        network.AzureFirewallApplicationRuleArgs(
-                            description="Deny external Ubuntu Snap Store upload and login access",
-                            name="DenyUbuntuSnapcraft",
-                            protocols=[
-                                network.AzureFirewallApplicationRuleProtocolArgs(
-                                    port=int(Ports.HTTP),
-                                    protocol_type=network.AzureFirewallApplicationRuleProtocolType.HTTP,
-                                ),
-                                network.AzureFirewallApplicationRuleProtocolArgs(
-                                    port=int(Ports.HTTPS),
-                                    protocol_type=network.AzureFirewallApplicationRuleProtocolType.HTTPS,
-                                ),
-                            ],
-                            source_addresses=props.subnet_workspaces_prefixes,
-                            target_fqdns=ForbiddenDomains.UBUNTU_SNAPCRAFT,
-                        ),
-                    ],
-                ),
+                workspace_deny_firewall_collection,
             ],
             azure_firewall_name=f"{stack_name}-firewall",
             ip_configurations=[

diff --git a/tests/conftest.py b/tests/conftest.py
@@ -530,6 +530,7 @@ def sre_config_yaml(request):
         admin_email_address: [email protected]
         admin_ip_addresses:
         - 1.2.3.4/32
+        allow_workspace_internet: false
         data_provider_ip_addresses: []
         databases: []
         remote_desktop: