azure-web-app-serviceazure-blob-storageazure-storageazure-virtual-network

Allow azure services(web application) to access the Storage Account using the Exception


Using my web application from Azure app service and the storage account's firewall setting is set to

Enabled from selected virtual networks and IP addresses

and I want my web app to access the storage account irrespective of any IP network using the Exceptions so I have enabled the following option

Allow Azure services on the trusted services list to access this storage account.

and still the blob files are not accessible from my web app.

Is there any other setting required to make this work?

I tried to allow the access using the VNet by creating new vnet and integrating it with the Web app and added the same vNet in the Storage account's virtual network setting, and still the Issue.


Solution

  • You can't use the Exceptions for trusted azure service to grant FW access to you web app. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-to-trusted-azure-services

    There are different ways to solve your problem depending on how locked down your solution need to be.

    But assuming that you want to keep your App integrated to your Vnet:

    Have a look at setting up a Service Endpoint between the Vnet and your Storage account. Then you can set you Storage Account FW rules with the Vnet's integration subnet.

    If you need more lock-down look into Private Endpoints between the Storage Account and your Vnet.

    Also make sure you have authorization set up properly so that it is not an access issue. Use access policies, or even better: a Managed Identity on the web app.

    And depending on what kind of app you have deployed you might need to add some settings to your app so that traffic to the service (the Storage Account) goes through the Vnet. Read up on settings like WEBSITE_VNET_ROUTE_ALL