How do I only grant Azure Compute Gallery network access to storage account?

Question

When we create a vm application version for a vm scaleset we choose the application package somewhere from a storage blob.

This works well as long as the firewall of the storage account is open to all networks.

However, if we limit the network access to the storage to specific networks, it is no longer possible to create a VM Application Version based on a blob in that storage. It now throws the error "The SAS is not valid for source uri"

How can we allow the Azure Compute Gallery to access the network of the Azure Storage without opening the firewall to all Networks.?

Answer 1

Thank you for asking this question on the Microsoft Q&A Platform.

You need to create a SAS URL; it is something like this:

You can create your SAS Token with the following documentation:

• https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers
• https://theautomationcode.com/how-to-retrieve-azure-storage-container-sas-url-using-powershell/

Let me know if this helps by accepting the answer!

---

Accept Answer and Upvote can help others in the community looking for remediation for similar issues.

NOTE: To answer you as quickly as possible, please mention me in your reply.