Azure Synapse Analytics - AccessDeniedException -> 6002 & 403 Errors from Firewall rules

Question

Azure Synapse Analytics - AccessDeniedException -> 6002 & 403 Errors from Firewall rules

Prodand 1

When I added firewall rules I get those errors.
From Pipeline
"errorCode": "6002",
"message": "Exception: Failed to create Livy session for executing notebook. Error: Received exception with statusCode=[400]. Message=[[traceId=91d5a9c1-e439-4590-94b6-6d681d2cae9d | client-request-id : 5624e403-1eed-4bb6-a685-9172fe8c03ec] Either the cores or memory of the driver, executors exceeded the SparkPool Node Size.\nRequested Driver Cores:[8]\nRequested Driver Memory:[56g]\nRequested Executor Cores:[8]\nRequested Executor Memory:[56g]\nSpark Pool Node Size:[Small]\nSpark Pool Node Memory:[28]\nSpark Pool Node Cores:[4]] HTTP status code: 400. Trace ID: 5624e403-1eed-4bb6-a685-9172fe8c03ec.",
"failureType": "UserError",
"target": "BR_Hyperion_Transformations",
"details": []

From notebook:
MetaException(message:Got exception: java.nio.file.AccessDeniedException Operation failed: "This request is not authorized to perform this operation.", 403 synapse

I have an Access Control role as Storage Blob Data Contributor in Storage account

In the firewall rules, I have added as a Resource Instances -> Resource type the Microsoft Synapse/workspaces and I have added the relevant resource

This is a firewall issue because when selecting the "Enabled from all networks" choice everything is working fine. Did anyone faced the same issue before and can assist?

Any help very welcome.

PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2022-11-07T05:56:44.45+00:00

Hello @Prodand ,

We haven't received any response from internal team. For a deeper investigation and immediate assistance on this issue, if you have a support plan you may file a support ticket.

1 answer

Your answer

PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2022-11-07T05:56:44.45+00:00

Hello @Prodand ,

We haven't received any response from internal team. For a deeper investigation and immediate assistance on this issue, if you have a support plan you may file a support ticket.

Answer 1

PRADEEPCHEEKATLA 90,641 Moderator

Hello @Prodand ,

Thanks for the question and using MS Q&A platform.

When public network access is disabled, you can connect to your workspace only using private endpoints.

For more details, refer to Azure Synapse Analytics connectivity settings and Synapse Managed private endpoints.

Hope this will help. Please let us know if any further queries.

------------------------------

Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
Want a reminder to come back and check responses? Here is how to subscribe to a notification
If you are interested in joining the VM program and help shape the future of Q&A: Here is jhow you can be part of Q&A Volunteer Moderators

Prodand 1 Reputation point

2022-10-11T16:00:38.447+00:00

Hi @PRADEEPCHEEKATLA ,

Thank you for your response.

This is not behind a Managed Virtual Network and won't be migrating to that solution. Both the links you sent apply only to Manage V-net.

Here is some additional information:
Access Control setup for Storage Account:
I have assignment Roles as Contributor, Monitoring Contributor & Storage Blob Data Contributor

Access Control setup for Synapse:
I have assignment Roles as Contributor and Monitoring Contributor

Firewall rules for Synapse & Storage account I have added the customer IP Addresses + MS gateway addresses.

From the Storage account in portal when I select "Enabled from selected virtual networks and IP addresses" option and run the pipeline with the notebook activity I get the 6002 error I mention above which is related to the spark pool. Next, I start working with the notebook, and I get again the same error with and I change the spark pool the error message changed (can't get access but is secure).

When I enable the firewall rules of the storage account to the public everything is working fine(can get access but not secure)
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2022-10-13T08:53:03.403+00:00

Hello @Prodand ,

Thanks for additional details.

I tried to reproduce the same scenario from our end and facing the same above issue. I'm working with the internal team and get back to you with my findings.
Jiehwan Yang 0 Reputation points

2023-06-09T21:55:58.2766667+00:00

I'm having a similar issue here where I have granted synapse a Storage Blob Data Contributor role, but it throws 403 error when I try to read data from the storage account in synapse notebook. I tried making a linked service to the storage account and was able to preview the data in there. It's just that I can't it in synapse notebook.

Could you share what was the issue stemming from and how you resolved it?
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2023-06-14T04:26:52.1466667+00:00

Jiehwan Yang - Since this thread is too old, I would recommend creating a new thread on the same forum with as much details about your issue as possible. That would make sure that your issue has better visibility in the community.

Share via

Azure Synapse Analytics - AccessDeniedException -> 6002 & 403 Errors from Firewall rules

1 answer

Your answer