Azure Storage firewall open to Azure App Service

3
votes

I have an Azure Storage account and need to enable the storage firewall.

I have added the outbound IP addresses of my App Service, but the firewall still prevents access. (I know that these addresses can change, but they change predictably, so I can live with that.)

Is there a solution to grant an App Service access to the Storage account other than disabling the firewall (and other than using an ASE, which isn't an option)?

2
azureazure-web-app-serviceazure-storage
May be this link helps:social.msdn.microsoft.com/Forums/azure/en-US/… – Joy Wang-MSFT
@Joy Wang Thanks, but not really. Assuming you can live with the predictability of the App Services changing (in my case I can), an ASE/VPN is not required to achieve what I needed. – Steve S

2 Answers

2
votes

So it turns out that in a new Azure Storage account with a new App Service, setting the storage firewall to the outbound IPs of the App Service does work as expected. Unless the client browser is actually doing the download, adding the client's IP is not required.

Edit

This only works reliably when the storage account is in a different data centre to the App Service. When they are both in the same data centre, an internal outbound address (e.g. 10.x.x.x) is presented from the App Service to the Storage account. Internal addresses cannot be added to the Storage firewall.

0
votes

If you access your web app service from on-premises networks, you need to grant access from your on-premise networks to your storage account with a public Internet-facing IP address used by your network. You can get more details from Grant access from an internet IP range

If you have VNet Integration with your apps. You should first enable service endpoints for storage in the VNet. You can refer to Grant access from a virtual network.