Enable malware scanner - Defender for Storage #3784
Conversation
anatbal
force-pushed
the
anatbal/3768-enable-malware-scanner
branch
from
eef5303 to
ef50fbd
Compare
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6822525447 (with refid (in response to this comment from @anatbal) |
|
@anatbal I have just reviewed the code and observed that a private endpoint is not being created for Scanresult eventgrid topic. Is there a specific reason for that? |
Hey @migldasilva. Yes, since the scan result publishing is not supported over private endpoints |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6848039669 (with refid (in response to this comment from @anatbal) |
|
@anatbal I have just deployed the this code and observed a small change in the overall behavior. After testing the whole import cycle, the blob container created inside |
You are right. I will dig into it and provide a code fix for that as well. |
…com/microsoft/AzureTRE into anatbal/3768-enable-malware-scanner
|
@migldasilva I have fixed the deletion problem, the final version of this PR is also deleting the container as it should, and was tested. |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6921189385 (with refid (in response to this comment from @anatbal) |
|
/test-destroy-env |
|
Destroying PR test environment (RG: rg-tree718abc7)... (run: https://github.com/microsoft/AzureTRE/actions/runs/6921229057) |
|
PR test environment destroy complete (RG: rg-tree718abc7) |
|
Destroying branch test environment (RG: rg-tre015d31d4)... (run: https://github.com/microsoft/AzureTRE/actions/runs/6921229057) |
|
Branch test environment destroy complete (RG: rg-tre015d31d4) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6921236648 (with refid (in response to this comment from @anatbal) |
3 similar comments
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6921236648 (with refid (in response to this comment from @anatbal) |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6921236648 (with refid (in response to this comment from @anatbal) |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/6921236648 (with refid (in response to this comment from @anatbal) |
| # If malware scanning is enabled, the fact that the blob was created can be dismissed. | ||
| # It will be consumed by the malware scanning service | ||
| logging.info('Malware scanning is enabled. no action to perform.') | ||
| send_delete_event(dataDeletionEvent, json_body, request_id) |
There was a problem hiding this comment.
I have tested this version and it's triggering a runtime error. The blob storage inside stalimip<TRE_ID> is being deleted twice. I could stop getting such errors moving this line to a if statement. Something like this:
if event_type is None or event_type != 'Microsoft.Storage.BlobDeleted':
send_delete_event(dataDeletionEvent, json_body, request_id)
return
A few lines above I checked if eventType is in the json_body, and if so, I assigned it the value store in the json_body.
I believe the deletion occur because, 1) the file is moved from storage account stalimip<TRE_ID> to a storage account inside the workspace, and it's the last blob in the storage account, and 2) the request status changed (I couldn't identify the correct order of execution).
There was a problem hiding this comment.
@migldasilva I will test this in a separate PR. Will try to reproduce on my end, since this shouldnt be triggered from a 'Blob.Deleted' event....
|
/test-destroy-env |
|
Destroying branch test environment (RG: rg-tre015d31d4)... (run: https://github.com/microsoft/AzureTRE/actions/runs/7180394756) |
|
Branch test environment destroy complete (RG: rg-tre015d31d4) |
|
Destroying PR test environment (RG: rg-tree718abc7)... (run: https://github.com/microsoft/AzureTRE/actions/runs/7180394756) |
|
PR test environment destroy complete (RG: rg-tree718abc7) |
Resolves #3768
What is being addressed
Since Defender for storage has become publicly available, it required many changes to the existing airlock import infra in order to make it work. This PR automates the process, but here is a complete description of the process in order for customers that are already using it can enable it themselves.
enable_airlock_malware_scanning: truemust be set.it's important to notice the event grid custom topic is publicly accessed since currently the scan results cannot be delivered over private endpoint.
@migldasilva, let me know if it's clear