0

I am trying to connect a (python) function app to a storage resource. The storage has a public container that is accessed by several company internal HTML/CSS pages ($web).

Unfortunately, this container should contain sensitive information. So in order to prevent leaking data my choice was to configure the firewall to only allow the IP range that is used by the company. So far this seemed to work fine.

However, no I tried to automatically generate files (blobs) using a function app. Since only very few executions are necessary, there is no real justification of using anything but the "Consumption" plan of azure function apps. However, apparently this is not part of the trusted azure services, neither has a fixed IP nor can the consumption plan be set-up in a VNet, and thus it could not pass the storage containers firewall.

I tried adding the function app as a role with contributor rights. I tried adding the outbound IP addresses of the function app (to be found in the resource manager) to the firewall. But both things did not work.

Is there any workaround for this?

New contributor
Timm is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

Consumption Plan Function Apps are not able to be joined to a VNET.

Premium Function Apps however, can be.

If the container has sensitive information then you should not make it public, IP restriction shouldn't be your only protection.

Use another service (such as a function app) to determine a user's identity: then grant them a SAS token for the container.

New contributor
Nathan is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Timm is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.