What's the effect of ipRules [] ?

Question

Hi,

Can someone please explain ipRules [] in ARM templates? Unfortunately the documentation is vague about it. I get it that it sets Sets the IP ACL rules but can you please provide an example? Can it include only allowed CIDRs or can it deny CIDRs too? Also, what's the effect of []? Everything is allowed or denied?

Answer 1

Hi @Mahdi Azarboon ,

it seems only allowed CIDRs are working in the ipRules. The format looks like this:

            "ipRules": [
                {
                    "value": "49.16.71.33",
                    "action": "Allow"
                },
                {
                    "value": "49.16.71.89",
                    "action": "Allow"
                }
            ],
            "defaultAction": "Deny"
        },

This defines 2 CIDRs are allowed and if the IP isn't in the list the access is denied.

This example with [] allows public network access from any IP:

            "ipRules": [],
            "defaultAction": "Allow"

And this one blocks all public network access because ipRules is empty (ipRules": []) and "defaultAction": "Deny":

            "ipRules": [],
            "defaultAction": "Deny"

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Answer 2

HI Mahdi Azarboon - Thanks for reaching out.

In storage, you can control the access on the network part as well to be limited to certain IP's or virtual networks and that's where you can configure the IP rules.

You can specify public IP, CIDR ranges and also VNET that you want to allow access too and it will ensure that access is only allowed to the calls being made from these IP's (authorize) while limiting the access for any other (Deny)

You can start with below link to gain more detailed insights on this as well:

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json&tabs=azure-portal

Hope that helps!

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.