Azure cost export to vNet integrated strorage container

Question

I am creating Cost export to my storage account which is vNet integrated & has only few IPs allowed via firewall.

I get the below error when i try adding the storage account.

Error: "Export creation failed.The exports service is not authorized to access the specified storage account 'mystoragecccount'. For more information see: https://go.microsoft.com/fwlink/?linkid=2127915 (Code: 400)"

Are there any IPs which can be whitelisted on storage to allow this Azure export service?

Answer 1

I don't believe this is supported currently. If you are restricting access to the storage account via a service or private endpoint then you are effectively firewalling it by denying access via the public endpoint.

https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-export-acm-data?tabs=azure-portal

It's also not possible to assign a system assigned managed identity to the Azure cost management service currently as an exception to the firewall configuration. I don't think public IP address whitelisting is a viable option either due to the fact this comes from an internal Microsoft management API service.

Answer 2

Check the following roles requirements are already completed for the account

1. Cost management Storage Account Contributor role
2. Cost management Reader role