Access images from Azure blob storage within vnet

1
votes

We have a site which is accessible to users logged in using their Azure AD account. The site uses Azure blob storage to store images. We use AccessKey to connect to the storage account and access the files within the container. The technology used are .Net Core and c#.

The IT team has asked us to bring the blob storage with VNet. We did the change by navigating to:

Azure portal> Storage Account>Firewalls and virtual networks>Allow access from> click 'Selected networks' option and then select virtual network and subnet.

However, after the above change, the pages have stopped showing the images and we are seeing 403 errors for the images. 'AuthorizationFailure, This request is not authorized to perform this operation..'

While the error makes sense, I just want to know what is the best way to fix this issue. Please note we have a lot of existing content and they hold a reference to existing images using their relative paths.

1
azureazure-storage-blobsazure-blob-storage
I am not an expert on this but I have a feeling that you are trying to get things done via the azure portal. if I were you, i would look at the code that was used to build your site, and then use the Azure blob storage API to do such permission related machinations. I doubt you will get what you are aiming to do with just the portal. – Jay
Now the reson for the issue is that after intergrating VNET, when we access azure blob, we cannot route the traffice to the vnet so we cannot access blob. If you want to fix it, we can add you client ip to firewall or create Azure VPN(docs.microsoft.com/en-us/azure/vpn-gateway/…) then access blob via vpn. – Jim Xu

1 Answers

0
votes

Azure blob is a PaaS service and accessible only via public endpoints. To access blob storage from your resources inside VNET you must create a private endpoint in addition to the Azure storage firewall changes you have made. Please refer to the Azure documentation for details:

https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints