|
| 1 | +--- |
| 2 | +title: Working with Azure Immutable Blob (WORM) Storage |
| 3 | +--- |
| 4 | + |
| 5 | +You can use the Azure Immutable Blob (WORM) Storage by creating a Rule and an Action in Governance Services. |
| 6 | + |
| 7 | +WORM storage (Immutable Blob Storage) is an Azure Blob Storage capability allows you to store objects using the write once, |
| 8 | +read many (WORM) model. Records moved to WORM storage use an Azure Blob Storage Container that is configured to support object locking . |
| 9 | +The movement of records is controlled through record folder rules and actions. You use the WORM model |
| 10 | +where it is a requirement that your data is not changed once it has been written to disk. This may be a requirement of |
| 11 | +yours due to regulatory compliance in the governmental, financial, or healthcare sectors. |
| 12 | + |
| 13 | +The movement of records to WORM storage and through to disposition can be fully automated. A folder rule is configured |
| 14 | +to test records for the classification that requires WORM storage. This may be based on when a records enters a folder |
| 15 | +or complex meta data conditions. When triggered the rule causes the Object Lock action to be initiated in Azure Blob Storage. |
| 16 | +This action is configured with the required WORM retention period in days. For records that are moved to WORM locked |
| 17 | +storage any retention schedules that may have been applied are interrupted. At the end of the required retention period |
| 18 | +in WORM storage the records are automatically returned to the original default Azure Blob container to allow normal record operations |
| 19 | +to re-commence, including the application of retention schedules and disposition. |
| 20 | + |
| 21 | +While retained in WORM storage additional controls are applied to prevent any user including administrators from deleting |
| 22 | +the records. Adding records to one or more legal holds during the WORM storage retention period causes the Azure Blob Storage legal |
| 23 | +hold flag to be set on the record in Azure Blob Storage. This prevents deletion or editing of the record in Azure Blob Storage even if the |
| 24 | +WORM retention period has expired. Once the record has been removed from all legal holds it was added to, the legal hold |
| 25 | +flag is cleared and the record can be removed from the WORM container once the retention period has expired. |
| 26 | + |
| 27 | +There is some configuration required before you can use this feature. For more see |
| 28 | +[Creating a container in Azure Blob Storage for use as WORM storage](#createcontainerforworm). |
| 29 | + |
| 30 | +Once you have created the container in Azure Blob Storage for use as WORM storage you can use it as storage. For more see |
| 31 | +[Using WORM storage](#usingworm). |
| 32 | + |
| 33 | +Although the content of a WORM-locked record will be protected against modifications, any copies of WORM-locked records |
| 34 | +in other record folders will be stored using the rules for that folder. Consequently, copies of records may not be protected |
| 35 | +by the same restrictions. |
| 36 | + |
| 37 | +You are unable to reject a Record that is stored in WORM storage and you can't move Records that are stored in WORM storage. |
| 38 | + |
| 39 | +## Configuring a storage account and creating a storage container in Azure for use as WORM storage {#createcontainerforworm} |
| 40 | + |
| 41 | +These steps describe how to use the Azure Portal to create a storage container for use as WORM storage |
| 42 | +(Azure Blob Level Immutability) in Azure. Once you have created the container you can create rules for a category or folder to |
| 43 | +store your data using WORM storage. |
| 44 | + |
| 45 | +For more on creating rules see [Creating a rule]({% link governance-services/latest/using/automate-fileplan.md %}#creating-a-rule). |
| 46 | + |
| 47 | +> **Note:** Ensure you have the required Azure login credentials before you begin. |
| 48 | +
|
| 49 | +* Installed Alfresco Content Services 23.2 (or above). |
| 50 | +* Installed Alfresco Content Connector for Azure 5.0.0 (or above) with multiple container support enabled. |
| 51 | + * For more see [Configuring multiple storage containers in Azure Connector]({% link microsoft-azure/latest/config/index.md %}#configuring-multiple-storage-containers). |
| 52 | +* Set the following properties in the `<TOMCAT_HOME>/shared/classes/alfresco-global.properties` file: |
| 53 | + |
| 54 | + | Property | Description | |
| 55 | + |---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |
| 56 | + | worm.contentstore | This property is the key of the content store that has a WORM container. | |
| 57 | + | worm.retentionPeriod | This property controls the default retention period. It is specified in days and the default value is `2192` which is six years. | |
| 58 | + | connector.az.store2.retentionPeriodProperty | This property passes the AGS property which stores the unlock date of an object to Content Connector for Azure. You must enter this value: `{http://www.alfresco.org/model/recordsmanagemententerprise/1.0}wormUnlockDate`. | |
| 59 | + | rm.wormUnlockRecords.cronExpression | This cron expression is used to specify how often the unlock job should run in Governance Services. The default is 15 minutes. | |
| 60 | + | connector.az.store2.blobImmutabilityPolicy | This property controls immutability policy type at single blob level. Possible values: `Unlocked`(default)/`Locked` | |
| 61 | + |
| 62 | +1. Log in to your Azure Portal. |
| 63 | + |
| 64 | + You can only enable Blob immutability policy on the creation level, so you must create a new Storage Account to enable WORM feature. |
| 65 | + |
| 66 | +2. Click **Create resource** and type **storage account** in the search field. |
| 67 | + |
| 68 | +3. Once the **Storage account** tile is displayed, expand the **Create** dropdown at the bottom of the tile and choose **Storage account**. |
| 69 | + |
| 70 | +4. On the first screen choose the desired subscription, resource group, enter a name for the storage, select the required Region, and then click **Next**. You can keep all other options default. |
| 71 | + |
| 72 | +5. Under the next two tabs, you can leave all options default or change them at your convenience. |
| 73 | + |
| 74 | +6. Under the **Data protection** tab you must select the **Enable versioning for blobs** and **Enable version-level immutability support** checkboxes. |
| 75 | + |
| 76 | + It is recommended to set `Keep all versions` under **Enable versioning for blobs**. |
| 77 | + |
| 78 | +7. You can leave the next two tabs with default values or modify them at your convenience and go to **Review** tab where you should click **Create** button. |
| 79 | + |
| 80 | +8. Under your storage account with versioning and version-level immutability support you need to create a storage container which is WORM capable. |
| 81 | + |
| 82 | +9. Under your newly created Storage Account go to the **Containers** tab and click **+Container** (create container). |
| 83 | + |
| 84 | + Type in the container name. Under **Advanced** section select **Enable version-level immutability support** and click **Create** |
| 85 | + |
| 86 | +10. You may want to set default retention based immutability policy for your container. |
| 87 | + |
| 88 | + To do so, go to the **Containers** tab, click the ellipsis (3 dots) for your container and choose **Access policy**. |
| 89 | + |
| 90 | +11. Under the **Immutable blob storage** section choose add policy. |
| 91 | + |
| 92 | + 1. Choose `Time-based retention` policy type and type in the desired number of days in `Set retention period for` field and click **Save**. |
| 93 | + |
| 94 | + This retention period must match the retention period you configured in the Alfresco Global Properties file for the `worm.retentionPeriod` property. |
| 95 | + |
| 96 | + 2. To use this bucket as WORM storage you must now create rules for a category or folder in Governance Services using the **WORM lock** action. If you use the REST API you can use the action without a rule. |
| 97 | + |
| 98 | +## Using WORM storage {#usingworm} |
| 99 | + |
| 100 | +These steps describe how to use WORM storage with Governance Services, how to use WORM storage when you specify a |
| 101 | +retention period, and when you use Legal Hold. |
| 102 | + |
| 103 | +This task assumes you have: |
| 104 | + |
| 105 | +* Created a container in Azure Blob Storage for use as WORM storage. |
| 106 | + * For more see [Creating a container in Azure Blob Storage for use as WORM storage](#createcontainerforworm). |
| 107 | +* Familiarised yourself with how to create rules in Governance Services. |
| 108 | + * For more see [Creating a rule]({% link governance-services/latest/using/automate-fileplan.md %}#creating-a-rule). |
| 109 | + |
| 110 | +1. Log in to Governance Services. |
| 111 | + |
| 112 | +2. (Optional) Click **More** and then **Add to Hold** if you want to use a Legal Hold for your new rule. |
| 113 | + |
| 114 | + Select the Hold you want to add the folders or categories to and click **OK**. |
| 115 | + |
| 116 | +3. Click **More** and then **Manage Rules** for the folder or category you want to set rules for. |
| 117 | + |
| 118 | + > **Note:** If you have selected a Hold then you will need specific IAM permissions on your AWS account to delete the record after the WORM-lock has expired. |
| 119 | +
|
| 120 | +4. Click **Create Rules**. |
| 121 | + |
| 122 | +5. Enter a name for the new rule. |
| 123 | + |
| 124 | +6. Define the rule. |
| 125 | + |
| 126 | +7. Select **WORM lock** from the **Perform Action** drop-down list. |
| 127 | + |
| 128 | +8. Enter a retention period in days. |
| 129 | + |
| 130 | + If you don't enter a retention period, the default period used is the one you set for the `worm.retentionPeriod` property in the `<TOMCAT_HOME>/shared/classes/alfresco-global.properties` file. |
| 131 | + |
| 132 | + > **Note:** When using the WORM Lock action you must select **Run in Background** when creating rules for your categories or folders. |
| 133 | +
|
| 134 | +9. Click **Create**. |
0 commit comments