Can't access Storage account using User Managed Identity in a Azure ML Worksapce

Dinesh Goyal 0 Microsoft Employee

I am getting error while attempting to connect storage account to AML workspace using user managed identity in a Jupiter Notebook, I encountered the following issue.

AzureConflictHttpError: Public access is not permitted on this storage account. ErrorCode: PublicAccessNotPermitted

1 answer

Amrinder Singh 2,685 Reputation points Microsoft Employee

2024-05-02T09:21:08.3033333+00:00

Hi Dinesh Goyal - Thanks for reaching out.

It appears that you are trying to access the container anonymously however the allowblobpublicaccess property on the account is disabled.

https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#set-the-storage-accounts-allowblobpublicaccess-property

Can you try enabling the same and then try performing the operation again.

Please let me know if there are any more queries and will be glad to assist.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.
Dinesh Goyal 0 Reputation points Microsoft Employee

2024-05-02T10:42:28.27+00:00

I have enabled the anonymous access, and all the required roles are also provided.

Dinesh Goyal 0 Reputation points Microsoft Employee

2024-05-02T10:46:52.9966667+00:00

.....................

Dinesh Goyal 0 Reputation points Microsoft Employee

2024-05-02T10:47:35.6+00:00

Thanks @Amrinder Singh I have enabled it. Still the issue is same. My container is private, could this be a issue? Error: azure.common.AzureConflictHttpError: Public access is not permitted on this storage account.
ErrorCode:
PublicAccessNotPermitted

<?xml version="1.0" encoding="utf-8"?><Error><Code>PublicAccessNotPermitted</Code><Message>Public access is not permitted on this storage account.

RequestId:6fba9cda-301e-00a2-2b7d-9ce8b6000000

Time:2024-05-02T10:41:59.9200834Z</Message></Error>

Provided all the required role to Managed Identity:

Storage account configuration:

Amrinder Singh 2,685 Reputation points Microsoft Employee

2024-05-02T11:12:54.02+00:00

Hi Dinesh Goyal -

I believe the MI configurations aren't even getting picked. If the call is try anonymous access, it is not coming via MI and also the exception points to the same. Also had it been w.r.t. permissions on MI, the exception would be AuthorizationPermissionMismatch which doesn't seem to be the case in here.

If you have enabled the public level access and still the container is private, then also you will be more likely getting similar exception. Can you try changing the access level of the container to public and then test it again once.?

Dinesh Goyal 0 Reputation points Microsoft Employee

2024-05-02T12:04:12.4033333+00:00

Got it @Amrinder Singh
As per security policy I can't change the access level from Private. Is there any way to access private container from azure resource by using managed identity?

Amrinder Singh 2,685 Reputation points Microsoft Employee

2024-05-02T16:03:47.5566667+00:00

Dinesh - Based on the above snippet you already have provided the management as well as data plane role to the MI so from the permission standpoint that is apt.

However, the problem here appears to be that the call is not coming via MI and rather anonymous auth, hence the failure.

Can you please review your notebook configuration and verify if you have enabled Auth via MI in there?

Amrinder Singh 2,685 Reputation points Microsoft Employee

2024-05-10T15:16:16.9766667+00:00

Hi Dinesh - I hope you doing good. Following up to check if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Dinesh Goyal 0 Reputation points Microsoft Employee

2024-05-10T19:13:18.4+00:00

Hi @Amrinder Singh sorry I missed this.
After running download using dataset it worked.
msi_auth = MsiAuthentication(
identity_confg={"cl": "xxxx"}
)
ws = Workspace(

subscription_id="xxxx",

resource_group=<resource_group>,

workspace_name=<workspace_name>,

auth=msi_auth,

)

blob_ds = Datastore.get(ws, "default_blob_store")
**dataset = Dataset.File.from_files((blob_ds, file_path), validate=False) dataset.download(".", overwrite=True) print(f"successfully files download = {file_path}")
**
But there is another issue this only worked in AML Compute, in AML cluster it's breaking with error.
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01&clientid=<Cliend_id> with an error of 'InternalError - :{ Info: Request failure status code: 404

}'.
Sign in to comment

Share via

Can't access Storage account using User Managed Identity in a Azure ML Worksapce

1 answer