从 vnet 中的 Azure blob 存储访问图像

Question

We have a site which is accessible to users logged in using their Azure AD account. The site uses Azure blob storage to store images. We use AccessKey to connect to the storage account and access the files within the container. The technology used are .Net Core and c#.

The IT team has asked us to bring the blob storage with VNet. We did the change by navigating to:

Azure portal> Storage Account>Firewalls and virtual networks>Allow access from> click 'Selected networks' option and then select virtual network and subnet.

However, after the above change, the pages have stopped showing the images and we are seeing 403 errors for the images. 'AuthorizationFailure, This request is not authorized to perform this operation..'

While the error makes sense, I just want to know what is the best way to fix this issue. Please note we have a lot of existing content and they hold a reference to existing images using their relative paths.

Answer 1

Azure blob is a PaaS service and accessible only via public endpoints. To access blob storage from your resources inside VNET you must create a private endpoint in addition to the Azure storage firewall changes you have made. Please refer to the Azure documentation for details:

https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints