windows-ansible/ansible/roles/win_study/tasks/permissions.yml

---
- name: Set permissions
  tags: set_permissions
  block:
    - name: Add study group permissions to study folder
      win_acl:
        path: "{{ item }}"
        state: present
        type: allow
        user: "{{ study_code }}"
        rights: Read,Write,Modify,Delete
      loop: "{{ s_drive_folders }}"
      retries: 10
      delay: 10

    - name: Add file-manager permissions to study folders
      win_acl:
        path: "{{ item }}"
        state: present
        type: allow
        user: "{{ filemanager_user }}"
        rights: 'FullControl'
      loop: "{{ s_drive_folders }}"
      retries: 10
      delay: 10

    - name: Add file-transfer user permissions to study folder
      win_acl:
        path: "{{ study_folder }}\\export"
        state: present
        type: allow
        user: file-transfer
        rights: 'FullControl'

    - name: Remove Users permissions
      block:
        - name: "Remove Users permissions from {{ study_folder }}"
          win_acl:
            path: "{{ study_folder }}"
            state: "{{ item }}"
            type: allow
            user: "Users"
            rights: "FullControl"
          loop: ["present", "absent"]

        - name: "Remove Users permissions from {{ study_folder }}\\export"
          win_acl:
            path: "{{ study_folder }}\\export"
            state: "{{ item }}"
            type: allow
            user: "Users"
            rights: "FullControl"
          loop: ["present", "absent"]

        - name: "Remove Users permissions from {{ study_folder }}\\import"
          win_acl:
            path: "{{ study_folder }}\\import"
            state: "{{ item }}"
            type: allow
            user: "Users"
            rights: "FullControl"
          loop: ["present", "absent"]

    - name: Protected Zone Tasks
      tags: protected_permissions
      block:
        - name: Add exporter group permissions to study folder
          win_acl:
            path: "{{ study_folder }}\\export"
            state: present
            type: allow
            user: "{{ exporter_group }}"
            rights: Read,Write,Modify,Delete

        - name: Remove study group permissions export folder
          win_acl:
            path: "{{ study_folder }}\\export"
            state: absent
            type: allow
            user: "{{ study_code }}"
            rights: Read,Write,Modify,Delete
      when: project_zone == 'protected'