question

KaleVaibhav-3069 avatar image
0 Votes"
KaleVaibhav-3069 asked prmanhas-MSFT commented

Access azure storage account from pipeline agent in same region with access restrictions enabled

Hi,

I am using Azure Batch service to create Pool of VMs. This Azure Batch Pool is created with specified public IP addresses as per link

I have configured Azure Storage account in same region with selected network access, and am allowing the static public address in selected network. Still my Azure Batch pool VMs seem unable to access this storage account. I found another link https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-an-internet-ip-range which states that "Services deployed in the same region as the storage account use private Azure IP addresses for communication. Thus, you can't restrict access to specific Azure services based on their public outbound IP address range."

If I understand this correctly, Azure Storage accounts in different subscription/tenant but same region will not be able to use the static public Ip address of the Azure Batch Pool in the same region? This seems to be a big limitation for Azure Batch service trying to work with data from different Azure storage accounts. Can you please clarify?

Found a similar unanswered question https://stackoverflow.com/questions/65019375/access-azure-storage-account-from-pipeline-agent-in-same-region-with-access-rest

Thanks,
Vaibhav

azure-storage-accountsazure-batch
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@KaleVaibhav-3069 Apologies for the delay in response and all the inconvenience caused because of the issue.

I have reached out to our internal team on this and will keep you posted once I have an update.

Thank you for your patience over the matter.

Thanks

0 Votes 0 ·

@KaleVaibhav-3069 Any update on the issue?

If the suggested response helped you resolve your issue, do click on "Accept as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.

Thanks.

0 Votes 0 ·

1 Answer

prmanhas-MSFT avatar image
1 Vote"
prmanhas-MSFT answered

@KaleVaibhav-3069 Thank you for your patience over the matter!!!

I had discussion internally and below is the response I got :

The best approach is to have nodes join a VNet that has access to the storage account.
As far as I know IP filtering doesn’t work from any Azure resources in the same region (or its pair region) due to the optimized networking that storage uses. This is a limitation of storage not Batch.

You can share same as feedback as well here.

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.






5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.