question

VladMenshchAdmin-6329 avatar image
0 Votes"
VladMenshchAdmin-6329 asked VladMenshchAdmin-6329 commented

Azure Functions Access to Restricted Storage Accounts

With requirements for additional security, we have network restrictions on our Azure storage accounts. I removed restriction to one storage account and created Function App that works great. As soon as I change the storage account to Selected Networks, Function App gets an error System.Private.CoreLib: Access to the path 'C:\home\site\wwwroot\host.json' is denied.

If I add WEBSITE_RUN_FROM_PACKAGE =1 I get read only access to Function App.

How do get full access?

azure-functionsazure-storage-accounts
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

PierreLucGiguere-5297 avatar image
0 Votes"
PierreLucGiguere-5297 answered VladMenshchAdmin-6329 commented

Hi Vlad,

Can we have a list of all of the Application Settings that you have for your Functions?

There are several network options, they can all be found here:

https://docs.microsoft.com/en-us/azure/azure-functions/functions-networking-options#restricting-your-storage-account-to-a-virtual-network

Without having access to the App Settings, I would say that you seem to be running into the same problem that these folks are:

https://github.com/Azure/Azure-Functions/issues/1349

Let me know if that helped.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Pierre,

the link that you have provided to github is for Premium subscription. I am using Consumption plan which doesn't support Vnet integration. Function App is not using any kind of firewall restrictions. The network restrictions are applied the storage account level. in the networking tab on the storage account I changed it from All networks to Selective Networks and that is when Function app stops working and can't access the blob


133170-fun.png


0 Votes 0 ·
fun.png (39.4 KiB)

Turning on firewall rules for your storage account blocks incoming requests for data by default, unless the requests originate from a service operating within an Azure Virtual Network (VNet) or from allowed public IP addresses. Requests that are blocked include those from other Azure services, from the Azure portal, from logging and metrics services, and so on.

I Do believe that this is why it is not working.

Source : https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

I can't find a way to put function app in the exceptions.

0 Votes 0 ·

I agree, without upgrading to a Premium subscription and creating Vnet integration there is no work around. I guess it's the limitation of the free service. I found that I can resolve my issue by using Logic App instead of Function App.

1 Vote 1 ·