(perform_data_egress)=

# Perform data egress

> This task is the responsibility of {ref}`role_tresa`.

The {ref}`role_tresa` should ensure that the authorised egress contact follows these instructions:

(perform_data_egress_contact)=

## Perform data egress as authorised egress contact

The Safe Haven is built on the Microsoft Azure platform.
The most convenient way of safely transferring data from the TRE is to use [Azure Storage Explorer](https://azure.microsoft.com/en-us/features/storage-explorer/).
You will not need log-in credentials, as your {ref}`role_tresa` will provide a short-lived secure access token which will let you upload data.

### Prerequisites

```{important}
- You must be able to receive a secure email.
  We recommend the [Egress secure email](https://www.egress.com/) service, which is free to setup for receiving secure emails.
- You must know the public IP address(es) that are used by the people in your organisation who will be downloading the data.
  Talk to your IT team if you're not sure what these are.
```

You will send your {ref}`role_tresa` the IP address(es) and they will respond by sending a secure email to the designated downloader.
This will contain the secure access token, which has **read** and **list** privileges, allowing the downloader download the files.

### Downloading your data

1. Open `Azure Storage Explorer` ([download](https://azure.microsoft.com/en-us/products/storage/storage-explorer/) it if you don't have it)
2. Click the socket image on the left hand side

    ```{image} img/azure_storage_explorer_connect.png
    :alt: Azure Storage Explorer connection
    :align: center
    ```

3. On `Select Resource`, choose `Blob container`
4. On `Select Connection Method`, choose `Shared access signature URL (SAS)` and hit `Next`

    ```{image} img/connect_azure_storage.png
    :alt: Connect with SAS token
    :align: center
    ```

5. On `Enter Connection Info`:
    - Set the `Display name` to "egress" (or choose an informative name)
    - Copy the `Blob SAS URL` from your Azure portal session into the `Blob container SAS URL` box and hit `Next`
6. On the `Summary` page, hit `Connect`
7. On the left hand side, the connection should show up under `Local & Attached > Storage Accounts > (Attached Containers) > Blob Containers > ingress (SAS)`
8. You should now be able to securely download the data from the Safe Haven's output volume by highlighting the relevant file(s) and hitting the `Download` button
9. Alert the {ref}`role_tresa` team if egress was successful by emailing `trustedresearch@turing.ac.uk`,  or ask for help if something went wrong