From 5e551cc6f1908d9a0cb7b381fed3a7840e59a493 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christofer=20L=C3=B6f?= Date: Tue, 9 Mar 2021 14:56:20 +0100 Subject: [PATCH 1/3] Add doc on TRE concepts --- docs/assets/concepts.png | Bin 0 -> 8611 bytes docs/concepts.md | 46 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 docs/assets/concepts.png create mode 100644 docs/concepts.md diff --git a/docs/assets/concepts.png b/docs/assets/concepts.png new file mode 100644 index 0000000000000000000000000000000000000000..aa2120d838ee23934ba38b0b0fe59befa15ebf5b GIT binary patch literal 8611 zcmd6Nc|2QdyLN<@QbV_zi%zPjp{QBZTvbwPtf}T%%wh<#6-7&1Z4E)%s-lV-Y6_A~ zO*PMg5Y?JzVn~Ry?0w$f`F`i@_xs-Ocg`Q@kCm)vJfxL{mgg&l$F56Btv@<_ zaO3QST^#Zz(*297sW+G1%PdbWDAmv}hiw*Y%hm@C6 zY5I_YYLSP#6R=}?qC-kbN?3`%#Ku%3g2ISvfkf=H^$ar|QYq{Hzme*}@WPPwsg5X; z^)G8;hdT2qkmT;DUDVOeAoL*|a;Dxc@<5vjWGnhDhtr=5Qk-k8k!0 zA0;Lh#uN_fQYN?V8*wJR=1QT|{kTpeD@h0RS#qLM?V$`k+Kksz#_zQc6D75Z~ z_GGcDh_klIWL3kj&35p65Ka|VU?C%);DyrSw{;~L>t`WeUf79WfoJ2j1X~#QTvcQ? zZ=B7}R?sStXU35{`QbA|3p0r`>@5AhL;uRLI^f=s#hqc4Eva6XD<0U}<1tk4WG>$g&%0{#R8~kXwY74ZBUG={^U)&H8`8 z`OzYdGMl0{MMFq^_Q@)krQy_6TZ$kl6x=}Gm}#D!&Go@&+~9}%`$Qd)Mq#(xoRWI@ zq#91;WO*V!-7W<-fY|Y{xN<577;0F`87fctkEIBbS_+ab}eN?h@p=3rEvk6muCs$MhLp{nU z=OTVYtg)e@C<8LVr$Hn+zdCK~M-8ow(1)f-d7MGtL8}oKL_Ymv_;l;c7q{m7aD{#O zo2kP{2NDmdrt zx#Y*md0gplL&?!UMa3ge+uV;d$*oZm9%1d35^&3iTIVYIA(~Va^lULSPcgoV{PgI` zhEJTTaQPqc>}mWLqZoq272&LH@Yd!(HmvZ1w&sh;cX*pjSsd?(FuT?r=vU}>ooeQ= z(k7Bx*G5-x=aonHiZ1X}1c|Z-0eb>=BepC`HwC6fLNtx}_OE!!|e4rOT zzw-8gj!&ByqdP-rTj*CLv z4&!-W%@QMC)nE0}?pHWZ$ld(w9SJD^^KtBH-Ve>&S##Cm6sIroTcw3iHN-j6Fte5H zGXn}QvSqDsX6N8X3GwRGu07W(M@Pw`v4O?ULwBKq&#m*c)1-n-Vk5d3y<4h3idsd< zAq8bnJrY=pq>^T}lI}4z@Vd+S@POyH#>9(0N}T08hWAM>ri|m%MG3J3d1{O1E?G*?rJpTzu*`^Ul9ULeN?EWASxf zT|^QOMVCl;`rYNMwdVM9%S+rnsgfP^N{AJ{0oD)O#*cIY)TX7{zL&W8J6i!R*6!Wi zkGyWEXLi4EtwycAM^5)nFVgl=iK^dif6F9{hsDe{qt{CoB0*m}njQIX4ac`&-rq|v zkx%LxZ!*>x{Pw58H1Ax=9}ClrSsD8Lh#Bkm8lg5r$u9{Nxx-Z_m_Qkv;e0+PBCxED z(jo>G`d9Y=vq@D#8jkrIrU7&G~%)1j8 z$*ca~M1{Y_6oNQi&b@1n;A}p0qW%siyqp`6bGsCv&b9URpw6Ce^Mv1#^j`O2zz6$( zVqSgvsT4uA#(%&efTuBewCl5NDX^*fQ2M}oRRvxqgz|s|@r}mFBVI#DUojL7S&Ynv za$7PPHRDnP#PZFVZl}4hrcZ&PJwXZwx2u1)N6fCz&=h-L+SobQR}^yC67YxyKtCk_ z{lG~2&j45hwxTHlFkFZYj$8W6TK{@CCakTY{(Y(KDhumFqyPY~OAPfK?k3E^l(f7z zd~V2-U?DKO#k$ZwYR9=+0KuS5w7&;sSvO15AQpdL-K)em&qZ}i*ZxF+aOPWC*++az8b^>*wG@bif^0@`kdogEcC@xMBi;7+I^CP^grTTZwS%1ZA zaz}8zaq@7Ow+P-5c`6CLV#fi736!hv>0)TOe(fFC!}cdh-RLAm^n?!Zc0RlDx!AAq z-tN5R@SFHKz9!9y=4rO3=0bJrhAwvACP%x{*~eLaDQ&u1br_=o(={YTX5Geixs9+Y zZ6}Q<7X)>i}7+q5JSCXyRGjrg(CiL!g9acp#@TyHf`;!7sj#v-f80CJ$#W5 z()%ozR+Z#4T&%5gN8E49{+R~)ZB}wQ$~CT7V#3bOJH2sa*i+NOourMj9g`V>y?Ohi zNLd*SGp!SOwIbF)aE%Zq2#}sFdmLpb)|m8tpZs~TM7`P^Qsc>OAoTiOK)Ugk>vfjw zZQ~U$F1ZpO8(9+*B|AYd?6fhjteZQUnn=k=v`Y2Y`?2AGF`S%q$X~o zFNGr|^7eS5dizoF>6WY2DHsu`OE8s6+W#xbm%ZQ&HGZuW(+WpC37e_2S% z4k#`f_83K26lGdlOiAOt$>h@v^`-_#y{KW#?`uyIsD6Uq`GfB( zrC2hU(RL46&X3A-k3MyUa=h*tjmKfqC+KS<%$<}6I>fdH;16ndHKx?>2o?{vEF>F* z--7pGhS`(4bh;ToqQWh>dyPL!D*1VnL~87HVxZzHU8H#JjWg>J^4xG2$J%w4I0H60 zt#J{`eeb<@Q7c7IW@D7>*_?-0RokXh3~fBj@4spN_0XUoiEp|)htv8`C(-Ya>tnuf ze&T(({?_d4G*N<$sa$h9{uuAOJMj4rj!Gf4T1SzvZZ}ia1W%^`>BaKVFZNNFBHvT1 zKkHaMO;edVtv+I6dBEFL%o#9D+lL9Bt9sSy(LTQ9xJfyPQI9CrG{qg9G;Qd9zt-1* ztpfYIeOjKrhq9zi+OGHW(zh191=dAI%>k(gvrx{DN_ITpb!i{LpYz|=pISJ>@(0*H z8L%Qc<)0EI+S@wmBM$f=+xuA|MJ2)9GGfl2mA&`lrJFzc3_H(r#RtqKv5y+6#(Jsu z|7_Y?OC|i=bn9|qs9*KtyRoWrNw?QayHcHKgCpFCsf5Oh)>^Tg;#hyX$^R<6a~@W1 zPlqTFa*UIYaCx3TUCaV)-n%2jbDi%N$Cl5gdyaJ#Pe&s3eVF&E$cm#H|Y%LYfy?xlG-ipObkLs=dI;V@&Zp!hx&g`2p@-_#7hcldtsB?5vVf9Rg7hD}%gVNsqknfw(`A(M*a zxb=5m-1Xl5`J1;?&WdBm;xDJl5^yQGj>bmB2U5Xs#q*K}H{5^V=f}d>MYi&4)RKYS z4SZXi1L>nA=kkNc4y3uSPG|=^Gg_Aph;dDFzN%&v)bPU5?CNr?(peP*-OdvKaV59!GX@o6EpUhetP=nnrk6LO=YgY0i%8R} z4N&_&U?U)(_$oyYW`#=tgx9n}qY3l{F(LQn(NW)LM!|hTz-5531^U$fCLJKO_in6U zInD$=0aAz%Cg4%bfJB3H%Xh3}8~#;U#jS;?HK>ssUL9>t$$bNT=v%vtl@=pYk0|rK z=zmOG+B1!UPG{JBzPHn!X>ETw+)&nL!SV`57;~R78{R)Ry7p_8202<5KRbo34G6{@ z`Mu*$$!CL`&PQ-6o@2L6ZCI^49l$hYOB7e&K!*H=98I2v*L4z-Q!rl?s1^c9^DD64 zUEOL=C;nFKQy#En(VZ77qdcssRV?L-(gMuX`PXbsE(xK z7KuUqCEYG>lT|Onu&P2@{s;$07#~vpGR7d}UIzT#XN>gpFjThX$n58Rqn*(f8_5Y% z+rqvj-O+90@+@(U5s@{Vc15=_Y@t-ODQwUF0RKa{b&oY9oM-WmmMXz(vaI?~D^O&I zjc*}>#U38G{uRi$aS^KN>GP%8X!pzwDU)QEO;%m~I=bUGb8+oCFH{xDi`n=`$!g4B zw@vTdVujw9C)Q~rsf)enw zakynGa;wumob)ZOl4H$p^}JFr)-|T)bi;MQh_Nv%z`Nv^r<()#gt)4+@dh~}Xg6M% zW5uQp=GOFU_jDtyy>#et_4K-y#mYCW7&zl<_2rf)(3Eu@!8(P=O(6de^s+XaH8o(q z-de#5HE-p~*-c0@$WG7O)v);;H*xiNQFN`TKkmZaWWxJd16#F4rNnhN9hI`O>QzoK z%&@$-T-9yYrdGXsSEc{e`j%H)+F!5SQtzJQbuPDzaVFT7Z!T+-u+V&J>f2-ddo74* zM~MfS$HZlHO1jRwJ+7cvMK$TWZGk=;+{$Q0qhfQ5AU7Uf)ubwy>x3EQ*m_pn6<#4M zzpHZ&ZdO&Sf<;w|uE-#6z^c2RZD>8H3L2c9rC!98jSZJv$H=~F&X!xjd+o*58aLQV zR@Ci9mYD}@UruXXJXG$5d+$~nxO+rA5Iiu=Q{qu=(BrzaQFYm?GVp2M`D*C+-R4bs{`hT)L>t${13h`=TQX&3z+TZm+}$p> z;d)%mE|(|veRtF9yH~SED&#l&zOl=BB(kBfdP^7o(}vAxxMYs_AZKR#gvTvTyS zeDN1UefI`znM`_@S!GPRd`1NB`%^ ze^yWAw`5cl44rtKlhsysz5d{|hh z67M;lKgJn#d{q4>NA+%wuXL>1o=gDbUtj-t4v<#QqD<)&Kvs+(n+(;}Zv+1<9s3)J zi~qE(-wL2cnIAd(=BDqoAU+tQRBN^Po(fSS$UAzdqf+~*{SEb#_869Sdv7`l8+8oK z4s^?4c_O2tO25`RliNFmBs1lDfn+puS!yHk_&9gT&O~9pG@_nZ8rv>3{^$l^gZVy} zb;{oQpN-#jQL2C1k*a#LgAX_xoCi!EvI({Ym?<+=bHa+~SJ{sR%({JswMP1%3UP4c z4|6XGU^xMC4#!j;qst8kp@t9 zqL%^klmrF?fiA5rApDg;nZl)_YM7F~Hyo2Qpk3Bwe|x@|EpuX@?>{4IVz%C{oAKoag~Pe5T=o$u;b*Vu0mqyU zLhB|ap-2b%U7v|0XswxTLk$=;L)`KJfE*qs~wU=I)%E3w~_67y+jJj7)B^0Hk6C`Q^`A??4cbf>o_Ty(^XAs z$u`bJi}i}u;KW>vHsue4_``%TE;B~z1NVY^MbG=&1T#b{pmxq_t_OK@r3O_4uAhs` z1?&m{e_IalMsoSU4C|ViO=nIE?TOZA*S?=@JuLRFp$wyTUNFS8a*Dh*Fyz&4=a)WQ z(p;H$y{o^Kw}Xn3ev5rUCLboAo6ef+(pUH9DXFveGkP&HcQ^PfRwXL-nhtqRT5bsa z1g1ATRtk={3;i6WZh>wH9$wJnDd}#EbDrKFl_Pl!0m2cfwh0P%>&?R}Jd^@>=mayK zrKobwsa-t>2ZC7~X;ErJVO&h#E^Gwr72ABW&jtT!RiQrm!UcpZ`(L#L+uMfS^%*Ca z1z?oxp;adC`@gR<^cZN2|9j*1@yQ7=6Vu6TfL*x$<1za907!!XwSmvNhSjE@@4F10 zb}WIcPc;m>Kod^@HXk0^CYcQ6Hw_|c5C|ZyJv@Qzc9tQ5NEuJ>5^b~^bw4IbpZx?E zfkf+Xh~b|??tdw-{ja(C1}_{9L4?tJ_4-s(MzPeq*m=r&)G-Bpe5lKWbEyZ2YwCta zWS4zEE>-wq#vU^$I{yyw2q-jW3I6BbO?d>eY$vSCFNm-Hr4dH zZRRYbUaG^Vlz+gpYL$zb3BZ$zmWjaN)DcV=PfYbU)pgskyc$anEcv?{97;S93|IthgIluM3Om1>qAch3P1Ewy=i}dm+wf*@=|7FeR(}S z*M?ri)T!EWQgF;qRR)!v$H3G;5MASqq2JUgt=?SGk(jY($E97>wN~`ZtkV)^WcD+D z_S*iHLdE)}jybEq65q1kFJsRuL)0weWq`z#Yw5)nQW_dQgsDR^iiQUgI_}wTZIQifBMtQGTvS&pwmk1T@P^~h zp47L9Ud_b>!kG3gtx4UCqe$Th^gCxIqiYhIent^Z+fj3Y>0?*gukkSsrlBotHxK;s=<^>uv(=O5BydtBirYEdq!y?u_R|4E4$b^#h`(^G#`C4GGc!_$nYqV=6yIYg;m`mw)Hd)< z$i*!Wy=8p7Q&!4-6LkY^IV7R>wSMRmwuUFqwpm}=q*koc{&cg9n61IvO8~IE{-D8m zlL}*CW5ekKQA7S={>7u$9J&z7rqD%S8eqViq?-LTt|ilpos{PoUZ0AyDH7(4}pnm2%QY{+jXaPzW@))$bb7P3ENI|)QH)nd1| ed)1Cvze-j6ex2>q1^!q8($hB7D$#iK`@aFg%a2C@ literal 0 HcmV?d00001 diff --git a/docs/concepts.md b/docs/concepts.md new file mode 100644 index 0000000000..a6ce416147 --- /dev/null +++ b/docs/concepts.md @@ -0,0 +1,46 @@ +# Concepts + +Trusted Research Environments enforce a secure boundary around distinct workspaces to enable information governance controls to be enforced. Each workspace is accessible by a set of authorized users, prevents the exfiltration of sensitive data, and has access to one or more datasets provided by the data platform. + +One or more workspace services are deployed into a workspace to provide resources accessible by the workspace users. + +The workspaces and the services can be deployed and managed via the Management API. + +![Concepts](./assets/concepts.png) + +## Workspace + +A workspace is a set of resources on a network with inbound traffic restricted to authorised users and outbound access restricted to defined network locations. The workspace is a security boundary in the fact there should be zero transfer of data outside of the workspace unless explicitly configured. Data transfer is not restricted within a workspace. + +Workspaces can be configured with a variety of tools to enable tasks such as the development of machine learning models, data engineering, data analysis, and software development. + +Multiple workspaces can be created within a single Trusted Research Environment to create the required separation for your projects. + +## Service + +A service provide one or more capabilities to you as a user of the TRE or to the TRE itself. Depending on the type of the service it is scoped to the environment and shared across all workspaces or scoped to a specific workspace. + +The types of services required for a research project varies greatly why extensibility is a key aspect of the Azure TRE solution so new services can be developed by you and your organization to fit your needs. + +Some workspace services are available from outside the protected network, such as a Virtual Desktop. Others such as Azure Machine Learning might need access restricting to via a Virtual Desktop. + +Below are examples of services that are available in the Azure TRE solution. + +### Shared services + +- Firewall +- Python Package Mirror +- Git Mirror + +### Workspace services + +- Virtual Desktop +- Azure Machine Learning + +## Workspace Service Resources + +Some workspace services allow users to create their own instances of the resources provided by the service in the current workspace. For example, the Virtual Desktop service allow each user to deploy their own virtual machines with remote access and storage. + +## Management API + +The Management API is an HTTP API surface that allows you to provision and manage workspaces and services within the TRE. By using the Management API you can integrate the TRE services lifecycle into your workflows and provide access to the services from your custom applications. From 7f86b55250f3a821691a8c36c926f754e6cfec5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christofer=20L=C3=B6f?= Date: Wed, 10 Mar 2021 15:01:38 +0100 Subject: [PATCH 2/3] Accept @Lybecker's suggestion Co-authored-by: Anders Lybecker --- docs/concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts.md b/docs/concepts.md index a6ce416147..f24c39900b 100644 --- a/docs/concepts.md +++ b/docs/concepts.md @@ -22,7 +22,7 @@ A service provide one or more capabilities to you as a user of the TRE or to the The types of services required for a research project varies greatly why extensibility is a key aspect of the Azure TRE solution so new services can be developed by you and your organization to fit your needs. -Some workspace services are available from outside the protected network, such as a Virtual Desktop. Others such as Azure Machine Learning might need access restricting to via a Virtual Desktop. +Some workspace services are accessible from outside the protected network, such as a Virtual Desktop. But no data will be permitted to be transferred outside the protected network. Others such as Azure Machine Learning might need access restricting to via a Virtual Desktop. Below are examples of services that are available in the Azure TRE solution. From ddf9298787c03f32c988c73d53c748401350465b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christofer=20L=C3=B6f?= Date: Wed, 10 Mar 2021 15:02:49 +0100 Subject: [PATCH 3/3] Accept @Lybecker's suggestion Co-authored-by: Anders Lybecker --- docs/concepts.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/concepts.md b/docs/concepts.md index f24c39900b..0f82a41ae5 100644 --- a/docs/concepts.md +++ b/docs/concepts.md @@ -28,6 +28,8 @@ Below are examples of services that are available in the Azure TRE solution. ### Shared services +These are services and resource shared by all workspaces. + - Firewall - Python Package Mirror - Git Mirror