Accessing Azure blob storage from inside and azure web app

Question

Good Afternoon

we have a web app using asp.net targeting .net framework 4.7.2 which we host on a server inside our offices. the app has access to an azure file storage account via blob storage.

recently we were tasked with migrating our app to azure so that we can retire the local server. however when we host the app in azure the cloud blob storage stops working.

when I try and access a file on the local server it downloads without any issues, the same action with the same code hosted in azure returns the following error. (see below)

I know that the credentials are correct as they are the same in both apps. so I suspect it is a permission issue within azure.

I am not sure what I am doing wrong here, any help would be greatly appreciated.

The remote server returned an error: (403) Forbidden. at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSyncT at Microsoft.WindowsAzure.Storage.Blob.CloudBlob.DownloadToStream(Stream target, AccessCondition accessCondition, BlobRequestOptions options, OperationContext operationContext) at Microsoft.WindowsAzure.Storage.Blob.CloudBlob.DownloadToFile(String path, FileMode mode, AccessCondition accessCondition, BlobRequestOptions options, OperationContext operationContext) at AWOL.Utility.CloudFileWalker.DownloadPdf(String fileName) at awol2.general.filewalker.Page_Load(Object sender, EventArgs e)

Answer 1

This error indicates that the request is being blocked by the firewall on the storage account. Check to see if you have restricted access using the storage firewall.
If this is the case, then granting access to a web app to a locked down storage account can be a bit tricky. Assuming you are running the web app and storage account in the same region, you cannot just allow access to the outbound IP's of the web app, as this will not work. You would need to either allow access to all Azure Services, or use vnet integration to join your web app to a vNet and then user service endpoints or private link to allow access.