Can not as assign static IP NAT GATEWAY to my configure Azure Container Apps (ACA)

Question

Hello,

I have configure Azure Container Apps (ACA) to use a NAT Gateway for static outbound IP but still NO assign static IP NAT GATEWAY to my configure Azure Container Apps (ACA)

Step 1: Create a new subnet with /23 => Done

Step 2: Associate subnet with NAT Gateway => Done

 Attach the NAT Gateway to the subnets used by ACA => Done

Step 3: Create ACA Environment => DoneStep 4: Get Public IP Assigned to NAT Gateway => Done

Step 5: Verify ACA Container’s Outbound IP => Wrong IP statuc nat gateway

Still wrong my ACA Container’s Outbound IP

Please help me this case?

Note: Because my aca is dynamic, every time I redeploy it, the public IP will change, so the third party must add a new public IP to be able to call my aca.

Answer 1

Nho Luong, you can’t force a static outbound IP on a consumption-only Container Apps environment. Azure will keep assigning dynamic IPs for egress. To get a fixed address you must rebuild your environment as a workload profiles type in a custom virtual network. That setup lets you attach a Standard SKU public IP via a NAT Gateway and ensures all outgoing traffic uses that same IP. You also need to place your environment in a subnet that is at least /27 in size.

• Check this below given script and modify with your own resource group, location and names.

# set your names
RG="MyResourceGroup"
LOC="eastus"
VNET="MyVNet"
SUBNET="AppSubnet"
ENV="MyAppEnv"
APP="MyContainerApp"
PIP="StaticEgressIP"
NAT="AppNatGateway"

# create a VNet with a /27 subnet
az network vnet create \
  --resource-group $RG \
  --name           $VNET \
  --location       $LOC \
  --address-prefixes 10.0.0.0/24

az network vnet subnet create \
  --resource-group $RG \
  --vnet-name      $VNET \
  --name           $SUBNET \
  --address-prefixes 10.0.0.0/27

# reserve a static public IP and plug it into a NAT Gateway
az network public-ip create \
  --resource-group $RG \
  --name           $PIP \
  --sku            Standard \
  --allocation-method Static

az network nat gateway create \
  --resource-group      $RG \
  --name                 $NAT \
  --public-ip-addresses $PIP

# link your NAT Gateway to that /27 subnet
az network vnet subnet update \
  --resource-group $RG \
  --vnet-name      $VNET \
  --name           $SUBNET \
  --nat-gateway    $NAT

# roll out a workload profiles Container Apps environment in that subnet
az containerapp env create \
  --resource-group $RG \
  --name           $ENV \
  --location       $LOC \
  --infrastructure-subnet-resource-id \
    $(az network vnet subnet show \
        --resource-group $RG \
        --vnet-name    $VNET \
        --name          $SUBNET \
        --query id -o tsv) \
  --enable-workload-profiles true

# deploy your container app into that environment
az containerapp create \
  --resource-group $RG \
  --name           $APP \
  --image          mcr.microsoft.com/azuredocs/containerapps-helloworld:latest \
  --environment    $ENV \
  --ingress        external \
  --target-port    80

After these commands finish, every outbound request from your container app will come from the static IP you reserved. Redeploys won’t change it.

Hope it helps!

---

Please do not forget to click "Accept the answer” and Yes wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or still running into more issues, let me know in the "comments" and I would be happy to help you.