Accessing Storage Account Containers and Blobs in Terraform with Selected Network

Question

Hello,

I am managing multiple storage accounts using Terraform and authenticating with Azure service principle. However, I am unable to access containers and blobs from GUI or Terraform after adding a storage account into a selected network, even with a private endpoint. The only solution is to whitelist my IP to a firewall rule in the storage account, which is not feasible for my CICD process. Are there any workarounds or suggestions to this issue?

Answer 1

@BM Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Apologies for the delay response here!

I would also recommend to post your query in developer community for more insights on your scenario. It would the better medium to get better help since the issue doesn't seem to be storage, but the CI/CD integration with it. 

As I understand you're facing challenges accessing Azure Storage accounts from a selected network, even with private endpoints, and you don't want to rely on whitelisting specific IP addresses for your Continuous Integration/Continuous Deployment (CI/CD) process. Here are some possible workarounds and suggestions to address this issue I haven't tried/repro the issue in my lab.

Azure Firewall or Network Security Groups (NSGs) : Instead of whitelisting specific IP addresses, consider using Azure Firewall or NSGs to control access to your storage account. You can configure these network security features to allow traffic from your CI/CD pipeline or specific subnets.

Azure Managed Service Identity (MSI): If you're running code in Azure (e.g., Azure Functions, App Service), consider using Azure Managed Service Identity (MSI) for authentication. MSI allows your resources to authenticate.

Private Endpoints for CI/CD Agents: If your CI/CD process involves agents or runners running in a specific network, you can set up private endpoints for the CI/CD agents so they can access the storage account privately.

Please let us know if you have any further queries. I’m happy to assist you further.

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.