Azure Functions Access to Restricted Storage Accounts

Question

With requirements for additional security, we have network restrictions on our Azure storage accounts. I removed restriction to one storage account and created Function App that works great. As soon as I change the storage account to Selected Networks, Function App gets an error System.Private.CoreLib: Access to the path 'C:\home\site\wwwroot\host.json' is denied.

If I add WEBSITE_RUN_FROM_PACKAGE =1 I get read only access to Function App.

How do get full access?

Answer 1

Hi Vlad,

Can we have a list of all of the Application Settings that you have for your Functions?

There are several network options, they can all be found here:

https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options#restricting-your-storage-account-to-a-virtual-network

Without having access to the App Settings, I would say that you seem to be running into the same problem that these folks are:

https://github.com/Azure/Azure-Functions/issues/1349

Let me know if that helped.

Answer 2

This is an old thread, but for posterity:

I also have this issue. Through careful reading of the documentation I found that when the storage account and function are in the same region, the communication is through private IP channels, not the IP address listed in the function's outbound IP list.

The answer I found here is to place them in different regions. I have recently tested this and it works. However, it leaves much to be desired...