Can't connect to Azure SQL Database from Azure Container Instances

Question

I've built a Windows container with my app inside and ran it locally. The app in the container connects to an Azure SQL Database, using the domain name from the connection string. SQL Server is configured to accept clients from any IP and from Azure Services.

Everything works fine locally. But when I run my container in Azure Container Instances, I get the following standard error:

A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.)

Added a rule with start IP 0.0.0.0 and End IP 255.255.255.255 — Denis Bredikhin
yeah, that should take care of that indeed. you sure you pass in the proper sql endpoint config? — 4c74356b41
Yes, I've already replaced my app with PowerShell script which just opens a connection - same result. — Denis Bredikhin

Leyshon Leyshon · Accepted Answer · 2018-12-14T14:32:33

You need to create a managed identity https://docs.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity and grant that identity permission to the SQL database.

You can then use the Microsoft.Azure.Services.AppAuthentication library to get an access token and use it during authentication. This is only available in dotnetcore 2.2 and .net 4.6 and above.

string connectionString = "Data Source=<AZURE-SQL-SERVERNAME>; Initial Catalog=<DATABASE>;";
SqlConnection conn = new SqlConnection(connectionString);
conn.AccessToken = (new AzureServiceTokenProvider()).GetAccessTokenAsync("https://database.windows.net/").Result;
conn.Open();

More info can be found in the below links. None of them are explicitly for ACI but it should be basically the same from a code perspective once you have created the MSI.

https://docs.microsoft.com/en-us/azure/key-vault/service-to-service-authentication https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-connect-msi

Can't connect to Azure SQL Database from Azure Container Instances

2 Answers