Cost optimisation - Firewall Basic SKU about azuretre

[marrobi]

Example: https://github.com/microsoft/AzureTRE/blob/main/resource_processor%2Fshared%2Fconfig.py#L24

[marrobi]

Should work fine. It's in the bundle, just dont think it's exposed.

Would be good to have an config value to configure it.

[jonnyry]

The Basic SKU Firewall is specifically excluded from deallocation in the start/stop script:

AzureTRE/devops/scripts/control_tre.sh

Lines 70 to 77 in 1ffb09b

	IPCONFIG_NAME=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].name" -o tsv)
	if [ -n "$IPCONFIG_NAME" ] && [ "${fw_sku}" != "Basic" ]; then
	echo "Deleting Firewall ip-config: $IPCONFIG_NAME"
	az network firewall ip-config delete -f "${fw_name}" -n "$IPCONFIG_NAME" -g "${core_rg_name}" &
	else
	echo "No Firewall ip-config found or SKU (${fw_sku}) doesn't allow deallocation"
	fi

If there aren't any other blockers then hopefully its just a case of:

• modifying the start/stop script to allow deallocation of the Basic SKU
• plus surfacing a FIREWALL_SKU environment variable

[marrobi]

Yes, that would make a lot of sense. Great if you can contribute it.

[jonnyry]

It's on my list! Just need to figure out how parameters get passed into the resource processor :-D

[marrobi]

https://github.com/microsoft/AzureTRE/blob/main/resource_processor%2Fresources%2Fcommands.py#L58

As long as the parameter matches the config key, it should just need adding to the config object.

[jonnyry]

Am I right in thinking the firewall is not deployed via the resource processor when the TRE is initially deployed? (since its the only shared service that's gets deployed on initial TRE deployment)

But then if the firewall is updated subsequently (e.g. via the TRE UI), this would update would take place via the resource processor?