Creating a container under a private storage account in Azure - azure

Question

I have a storage account created for an AKS cluster, which is configured with a private endpoint. Public access is denied on it.
There is a client service installed in the same network as the cluster, which is trying to create a container within this storage account.
Here is the code snippet:
c, err: = azblob.NewSharedKeyCredential(accountName, accountKey)
if err != nil {
return azblob.ContainerURL {}, err
}
p: = azblob.NewPipeline(c, azblob.PipelineOptions {
Telemetry: azblob.TelemetryOptions {
Value: "test-me"
},
})
u, err: = url.Parse(fmt.Sprintf(blobFormatString, accountName))
if err != nil {
return azblob.ContainerURL {}, err
}
service: = azblob.NewServiceURL( * u, p)
container: = service.NewContainerURL(containerName)
c, err: = GetContainerURL(a.Log, ctx, a.SubscriptionID, a.ClientID, a.ClientSecret, a.TenantID, a.StorageAccount, accountKey, a.ResourceGroup, a.Bucket)
if err != nil {
return err
}
_, err = c.GetProperties(ctx, azblob.LeaseAccessConditions {})
if err != nil {
if strings.Contains(err.Error(), "ContainerNotFound") {
_, err = c.Create(
ctx,
azblob.Metadata {},
azblob.PublicAccessContainer)
if err != nil {
return err
}
}
}
This code when executed throws an error like:
Details: \n Code: PublicAccessNotPermitted\n PUT https://storageaccountname.blob.core.windows.net/containername?restype=container&timeout=61\n Authorization: REDACTED
RESPONSE Status: 409 Public access is not permitted on this storage account
Should not the container creation be completed, since the client is already on the cluster. What is it that i am doing wrong?
Many thanks!!

Answer 1

Details: \n Code: PublicAccessNotPermitted\n PUT https://storageaccountname.blob.core.windows.net/containername?restype=container&timeout=61\n Authorization: REDACTED RESPONSE Status: 409 Public access is not permitted on this storage account
• The error code that you are interacting with clearly states that ‘public access is not permitted on your storage account’, i.e., either the private endpoint connection that you have configured on your storage account is not configured properly and the account is not secured by configuring the storage firewall to block all connections on the public endpoint for the storage service.
• Thus, I would suggest you increase the security for the virtual network (VNET), by enabling you to block the exfiltration of data from the VNET. Also, securely connect to storage accounts from on-premises networks that connect to the VNET using VPN or ExpressRoutes with private-peering.
• Also, please ensure that the IP address that is assigned to the private endpoint is an IP address from the address range of the VNET and it is excluded from any restrictions in the network security group or AKS ingress controller or the Azure Firewall.
• Finally, ensure that the private endpoints provisioned for the storage account are not general-purpose v1 storage accounts as private endpoints for these storage accounts are not permitted. Also, configure the storage firewall for the storage account as described in the documentation link below: -
https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#change-the-default-network-access-rule
To know more about the details regarding the configuration of private endpoints for storage accounts, kindly refer to the documentation link below: -
https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints