project create for protected zone

ansible/roles/win_domain_controller/tasks/setup.yml

@@ -105,7 +105,7 @@
         protected: true
       loop: "{{ OUs }}"
 
-    - name: Create file-transfer user for
+    - name: Create file-transfer user
       community.windows.win_domain_user:
         name: "{{ filetransfer_user }}"
         firstname: File
@@ -113,6 +113,15 @@
         password: "{{ transfer_user_password }}"
         state: present
         password_never_expires: yes
+        
+    - name: Create file-manager user
+      community.windows.win_domain_user:
+        name: "{{ filemanager_user }}"
+        firstname: File
+        surname: Manager
+        password: "{{ file_manager_password }}"
+        state: present
+        password_never_expires: yes
   when: inventory_hostname in groups['meta-name_dc01']
 
 

ansible/roles/win_study/tasks/permissions.yml

@@ -9,13 +9,24 @@
         type: allow
         user: "{{ study_code }}"
         rights: Read,Write,Modify,Delete
-      loop: ["{{ study_folder }}", "{{ study_folder }}\\export"]
+      loop: "{{ s_drive_folders }}"
+      retries: 10
+      delay: 10
+
+    - name: Add file-manager permissions to study folders
+      win_acl:
+        path: "{{ item }}"
+        state: present
+        type: allow
+        user: "{{ filemanager_user }}"
+        rights: 'FullControl'
+      loop: "{{ s_drive_folders }}"
       retries: 10
       delay: 10
 
     - name: Add file-transfer user permissions to study folder
       win_acl:
-        path: '{{ study_folder }}\export'
+        path: "{{ study_folder }}\\export"
         state: present
         type: allow
         user: file-transfer
@@ -48,4 +59,24 @@
             type: allow
             user: "Users"
             rights: "FullControl"
-          loop: ["present", "absent"]
+          loop: ["present", "absent"]
+
+    - name: Protected Zone Tasks
+      tags: protected_permissions
+      block:
+        - name: Add exporter group permissions to study folder
+          win_acl:
+            path: "{{ study_folder }}\\export"
+            state: present
+            type: allow
+            user: "{{ exporter_group }}"
+            rights: Read,Write,Modify,Delete
+
+        - name: Remove study group permissions export folder
+          win_acl:
+            path: "{{ study_folder }}\\export"
+            state: absent
+            type: allow
+            user: "{{ study_code }}"
+            rights: Read,Write,Modify,Delete
+      when: project_zone == 'protected'

ansible/roles/win_study/vars/main.yml

@@ -1,3 +1,6 @@
 study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
+export_folder: "{{ study_folder }}\\export"
+import_folder: "{{ study_folder }}\\import"
 archive_folder: "{{ studydata_drive_letter }}:\\Archived_Studies"
 exporter_group: "{{ study_code }}-exporter"
+s_drive_folders: ["{{ study_folder }}", "{{ export_folder }}", "{{ import_folder }}"]

ansible/vars/common.yml

@@ -16,6 +16,7 @@ user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d
 gpu_flavor: 3661211f-673a-4777-8857-fd243d6c407d # CHANGE THIS
 
 filetransfer_user: file-transfer
+filemanager_user: file-manager
 
 standard_vms:
   - { name: "{{ os_project }}-{{ win_project }}-dc01", security_group: "domain_controller", meta_name: dc01 }