How to send Vnet flow logs to azure centralized common Storage Account

Question

Hi Everyone,

I need to set up a centralized common storage account in an azure account (Eg: azureacc12).

To that common storage account need to send virtual network flow logs from different Azure accounts, azure account like Eg: azureacc1, azureacc2, azureacc3 from 3 different azure accounts\subscription need to set up virtual network flow logs to store in common or centralized azure storage account of different container

Note: Need to set up on irrespective of any azure account \ subscription

Answer 1

Dear Vikram,

Thank you for your question here at Q&A portal! I would be happy try to help you.

 

1. Set Up the Central Storage Account

Create or Identify a Storage Account (e.g., azureacc12) in your central Azure subscription.

Enable Hierarchical Namespace (if using Azure Data Lake Storage Gen2) for better organization.

Configure Network Settings to allow traffic from other subscriptions. Under Networking, choose Selected networks and add the relevant VNets or allow access from All networks (if security policies permit). Alternatively, use Private Endpoints for secure access.

 

2.Configure Flow Logs in Each Subscription

For each subscription (azureacc1, azureacc2, azureacc3):

Navigate to the VNet > Flow Logs > + Add.

Select the Target Storage Account: choose "Another Azure account" and provide the Storage Account ID (e.g., /subscriptions/[central-sub-id]/resourceGroups/[rg-name]/providers/Microsoft.Storage/storageAccounts/azureacc12).

Ensure the Storage Account Contributor (or Storage Blob Data Contributor) role is assigned to the logging service principal or user account.

Define Retention & Logging Settings: set retention (e.g., 30 days). Specify a container name (e.g., vnetflowlogs-azureacc1 for subscription-specific segregation).

 

3.Cross-Subscription Access (RBAC)

Grant Permissions: In the central storage account (azureacc12), assign Storage Blob Data Contributor to: Each subscription’s Network Contributor role (or a custom role) or, use a Managed Identity from each subscription for secure access.

 

Automation (if u like)

Use Azure Policy to enforce flow log settings across subscriptions. Deploy via Terraform/ARM/Bicep for consistency.

And last one, data transfer across subscriptions may incur costs. Use Private Links or VNet peering for sensitive environments.

Best regards,

Alex

P.S. If my answer help to you, please Accept my answer

Answer 2

Hi Vikram G,

Wellcome to Q&A, You're asking how to send VNet flow logs from multiple Azure accounts to a centralized storage account while considering constraints like regional storage requirements and organizational structure.- Since VNet flow logs must stay in the same region as the VNet, you first need to create storage accounts in each region where the VNets are located.

• Configure each VNet's flow logs to send data to these respective regional storage accounts. To centralize the logs, use tools like Azure Data Factory, Logic Apps, or Functions to periodically copy the logs from the regional accounts to your centralized storage account.
• The logs are organized within the storage account in a container, with subfolders for each VNet based on their resource IDs. Grant access by assigning the Storage Blob Data Contributor role and use AAD or SAS for cross-subscription access.:

<container_name>/
  resourceId=/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Network/virtualNetworks/vnet
    yyyy/mm/dd/<hour>.json
  resourceId=/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.Network/virtualNetworks/vnet
    yyyy/mm/dd/<hour>.json

References:

• https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manag
• https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
• https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory
• https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files

If the information helped address your question, please Accept the answer.

Luis