azureazure-virtual-networkazure-private-linkazure-private-dnsazure-private-dns-zone

VNET Peering and Private DNS zone

I have very specific question and hope to get some answers.

Below is my situation,

Question: When I do nslookup from VM in VNET1 I get private IP address(which is expected). When I do nslookup from VM in VNET2 I get public IP address(which is also expected as per the response I got from another post Azure VNet peering with Private Link). The solution I got is to add VNET link in Private DNS zone.

The real question I have is why I am able to perform all operations(upload blob/create container) from VM IN VNET2 even after getting public IP address for nslookup for storage account?

Also created diagram with my topology as well

enter image description here

Below is my network config for storage account enter image description here

Update: Adding updated diagram with all resources in resource group. enter image description here

Solution

  • As per MsDoc

    By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set Public network access to Disabled after previously setting it to Enabled from selected virtual networks and IP addresses, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account.

    enter image description here

    This means that if you previously granted access to a storage account from trusted services, such as Azure services or specific virtual networks and IP addresses, and then later disabled public network access to the storage account, the trusted services and virtual networks the previous configurations for trusted services might still be in effect.

    enter image description here

    In your case, it seems that the trusted services were granted access to the storage account from VNET2 before you disabled public network access to the storage account. This is why you were still able to access the storage account from VNET2 even though public network access was disabled.