config_schema.json

{
  "$schema": "http://json-schema.org/draft-04/schema#",
  "$id": "https://github.com/microsoft/AzureTRE/schema/config_schema.json",
  "title": "AzureTRE configuration file",
  "description": "This document contains all the configuration needed to deploy and setup AzureTRE.",
  "type": "object",
  "properties": {
    "location": {
      "description": "The Azure location (region) for all resources.",
      "type": "string",
      "pattern": "[a-z]+"
    },
    "tre_id": {
      "description": "TRE unique identifier",
      "type": "string",
      "pattern": "^[a-z0-9]*$",
      "maxLength": 11
    },
    "management": {
      "description": "Management configuration",
      "type": "object",
      "properties": {
        "mgmt_resource_group_name": {
          "description": "The shared resource group for all management resources, including the storage account.",
          "type": "string",
          "pattern": "^[-\\w\\._\\(\\)]+$",
          "maxLength": 90
        },
        "mgmt_storage_account_name": {
          "description": "The name of the storage account to hold the Terraform state and other deployment artifacts.",
          "type": "string",
          "pattern": "[A-Za-z09]+",
          "minLength": 3,
          "maxLength": 24
        },
        "terraform_state_container_name": {
          "description": "Optional. The name of the blob container to hold the Terraform state. Default value is `tfstate`.",
          "type": "string",
          "pattern": "^[a-z0-9](?!.*--)[a-z0-9-]{1,61}[a-z0-9]$",
          "minLength": 3,
          "maxLength": 63
        },
        "acr_name": {
          "description": "A globally unique name for the Azure Container Registry (ACR) that will be created to store deployment images.",
          "type": "string",
          "pattern": "^[a-zA-Z0-9]*$",
          "minLength": 5,
          "maxLength": 50
        },
        "arm_subscription_id": {
          "description": "The Azure subscription ID for all resources.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "encryption_kv_name": {
          "description": "Name of Key Vault for encryption keys.",
          "type": "string"
        },
        "external_key_store_id": {
          "description": "ID of external Key Vault to store CMKs.",
          "type": "string"
        },
        "disable_acr_public_access": {
          "description": "Set to true to disable public (anonymous) access to the management ACR.",
          "type": "boolean"
        }
      },
      "required": [
        "mgmt_resource_group_name",
        "mgmt_storage_account_name",
        "terraform_state_container_name",
        "acr_name",
        "arm_subscription_id"
      ]
    },
    "tre": {
      "description": "TRE configuration",
      "type": "object",
      "properties": {
        "enable_airlock_malware_scanning": {
          "description": "Allow airlock malware scanning.",
          "type": "boolean"
        },
        "enable_airlock_email_check": {
          "description": "Require email check for airlock.",
          "type": "boolean"
        },
        "core_address_space": {
          "description": "TRE core address spaces.",
          "type": "string"
        },
        "tre_address_space": {
          "description": "TRE address spaces.",
          "type": "string"
        },
        "enable_swagger": {
          "description": "Determines whether the Swagger interface for the API will be available.",
          "type": "boolean"
        },
        "firewall_sku": {
          "description": "SKU of the Azure Firewall.",
          "type": "string"
        },
        "app_gateway_sku": {
          "description": "SKU of the Application Gateway.",
          "type": "string"
        },
        "deploy_bastion": {
          "description": "Deploy Azure Bastion.",
          "type": "boolean"
        },
        "bastion_sku": {
          "description": "SKU of the Azure Bastion.",
          "type": "string"
        },
        "custom_domain": {
          "description": "Custom domain name.",
          "type": "string"
        },
        "private_agent_subnet_id": {
          "description": "Subnet ID of private runner agent.",
          "type": "string"
        },
        "core_app_service_plan_sku": {
          "description": "App Service plan SKU for TRE core services (e.g., P1v2).",
          "type": "string"
        },
        "workspace_app_service_plan_sku": {
          "description": "Default App Service plan SKU for workspace apps (e.g., P1v2).",
          "type": "string"
        },
        "resource_processor_vmss_sku": {
          "description": "VMSS SKU for the Resource Processor scale set (e.g., Standard_B2s).",
          "type": "string"
        },
        "user_management_enabled": {
          "description": "When true, TreAdmins can assign/deassign users to workspaces via the UI.",
          "type": "boolean"
        },
        "enable_dns_policy": {
          "description": "Enable DNS policy on the firewall to restrict DNS resolution to allowed domain list.",
          "type": "boolean"
        },
        "allowed_dns": {
          "description": "List of allowed DNS entries to be added to the existing allowed-dns.json list.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "authentication": {
      "description": "Authentication configuration",
      "type": "object",
      "properties": {
        "aad_tenant_id": {
          "description": "Tenant id against which auth is performed.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "auto_workspace_app_registration": {
          "description": "This identity is used to manage other AAD applications that it owns. Read more about it here: docs/tre-admins/auth.md",
          "type": "boolean"
        },
        "auto_workspace_group_creation": {
          "description": "This identity can create security groups aligned to each applciation role. Read more about it here: docs/tre-admins/auth.md",
          "type": "boolean"
        },
        "auto_grant_workspace_consent": {
          "description": "The identity will be be able to grant admin consent on new workspaces.",
          "type": "boolean"
        },
        "api_client_id": {
          "description": "API application (client) ID.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "api_client_secret": {
          "description": "API application client secret.",
          "type": "string",
          "minLength": 11
        },
        "swagger_ui_client_id": {
          "description": "Swagger/UI application (client) ID.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "application_admin_client_id": {
          "description": "This client will administer AAD Applications for TRE.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "application_admin_client_secret": {
          "description": "Secret to client which will administer AAD Applications for TRE",
          "type": "string",
          "minLength": 11
        },
        "test_account_client_id": {
          "description": "This is the app that will run the tests for you.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "test_account_client_secret": {
          "description": "This is the secret to an app that will run the tests for you",
          "type": "string",
          "minLength": 11
        },
        "workspace_api_client_id": {
          "description": "Workspace AD Application. This will be created for you for future use - when creating workspaces.",
          "type": "string",
          "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
        },
        "workspace_api_client_secret": {
          "description": "Workspace AD Application secret. This will be created for you for future use - when creating workspaces.",
          "type": "string",
          "minLength": 11
        }
      },
      "required": [
        "aad_tenant_id"
      ]
    },
    "ui_config": {
      "description": "UI customisation",
      "type": "object",
      "properties": {
        "ui_site_name": {
          "description": "Product name shown in top left corner of portal. Default value is 'Azure TRE'",
          "type": "string"
        },
        "ui_footer_text": {
          "description": "Text shown in bottom left corner of portal. Default value is 'Azure Trusted Research Environment'",
          "type": "string"
        }
      }
    },
    "resource_processor": {
      "description": "Settings for the Resource Processor service.",
      "type": "object",
      "properties": {
        "resource_processor_number_processes_per_instance": {
          "description": "Number of processes to start per VMSS instance.",
          "type": "integer",
          "minimum": 1
        },
        "rp_bundle_values": {
          "description": "JSON string of key/value pairs made available to bundles.",
          "type": "string"
        }
      }
    },
    "developer_settings": {
      "description": "Developer and local debugging settings (typically for non-production use).",
      "type": "object",
      "properties": {
        "stateful_resources_locked": {
          "description": "When false, locks are not added to stateful resources to ease teardown.",
          "type": "boolean"
        },
        "kv_purge_protection_enabled": {
          "description": "Controls purge protection for the TRE Core Key Vault.",
          "type": "boolean"
        },
        "enable_local_debugging": {
          "description": "Enables local machine access to Service Bus, Cosmos, and base workspace deployment.",
          "type": "boolean"
        },
        "enable_cmk_encryption": {
          "description": "Enables customer-managed key encryption for supported resources.",
          "type": "boolean"
        },
        "logging_level": {
          "description": "Logging level for API and Resource Processor.",
          "type": "string",
          "enum": [
            "ERROR",
            "WARNING",
            "INFO",
            "DEBUG"
          ]
        },
        "tre_url": {
          "description": "Override TRE API base URL (e.g., for local development or alternate clouds).",
          "type": "string"
        }
      }
    }
  },
  "required": [
    "location",
    "tre_id"
  ]
}