【Azure 存储服务】App Service 访问开启防火墙的存储账号时遇见 403 (This request is not authorized to perform this operation.)
问题描述
需要 App Service 访问开启防火墙的存储账号。存储账号中设置为允许选中的VNET访问,同时允许了信任的Azure服务的访问,但是仍然报错 “403 (This request is not authorized to perform this operation.)”
因为App Service 并没有与Stroage Account允许访问所选的VNET进行集成,所以App Service是通过Outbound IP地址与Storage Account进行通信。当Storage Account与App Service处于同一数据中心时,把App Service所有的出口IP地址都添加到Storage Account的 Firewall中,依然出现403问题。这是什么原因呢?
问题分析
查看Storage Account的IP网络规则文档,发现其中有一点 “限制对与存储帐户部署在同一区域中的 Azure 服务的访问 ” 这是因为与存储帐户部署在同一区域中的Azure服务使用专用的 Azure IP 地址进行通信。 因此,不能基于特定的 Azure 服务的公共出站 IP(App Service的出口IP) 地址范围来限制对其的访问。
如何来避免这个问题呢?
1)当App Service 与 Stroage Account 都处于同一区域时,可以把App Service集成在Storage Account所允许访问的VNET中,使得App Service与Storage Account通过VNET进行通信。
2)当App Service 与 Storage Account 不在同一个区域时,在Storage Account的Firewall中添加 所有App Service的出口IP地址为允许访问即可。
参考文档
配置 Azure 存储防火墙和虚拟网络: https://docs.azure.cn/zh-cn/storage/common/storage-network-security?toc=%2Fstorage%2Fblobs%2Ftoc.json&tabs=azure-portal#grant-access-from-an-internet-ip-range
将应用与 Azure 虚拟网络集成: https://docs.azure.cn/zh-cn/app-service/web-sites-integrate-with-vnet#regional-vnet-integration
- Host 'XXX' is not allowed to connect to this MySQL server 解决方法/开启MySQL远程账号
- GeoDatabase元数据不能编辑的问题“The application is not licensed to perform this operation ”
- Tomcat Manager App--403 Access Denied You are not authorized to view this page
- The application is not licensed to perform this operation
- Tomcat Manager App--403 Access Denied You are not authorized to view this page
- 【Azure 应用服务】App Service 配置 Application Settings 访问Storage Account得到 could not be resolved: '*.file.core.windows.net'的报错。没有解析成对应中国区 Storage Account地址 *.file.core.chinacloudapi.cn
- linux 访问tomcat 管理页面时 You are not authorized to view this page 403(真实可用)
- Tomcat Manager App--403 Access Denied You are not authorized to view this page
- Xcode上传ipa时itunes提示you are not authorized to use this service
- 【应用服务 App Service】在Azure Web App的部署文件中,是否可以限制某些文件无法被访问?(如json)
- Host 'XXX' is not allowed to connect to this MySQL server 解决方案/如何开启MySQL的远程帐号...
- 【Azure 应用服务】遇见“无法创建hybrid connection for App Service”的解决办法
- 解决Navicat 报错:1130-host ... is not allowed to connect to this MySql server,MySQL不允许从远程访问的方法
- Host 'XXX' is not allowed to connect to this MySQL server 解决方案/如何开启MySQL的远程帐号
- 调用app出现"This app is not allowed to query for scheme..."
- -canOpenURL: failed for URL: "wechat://" - error: "This app is not allowed to query for scheme wech
- Host 'XXX' is not allowed to connect to this MySQL server 解决方案/如何开启MySQL的远程帐号
- "This app is not allowed to query for scheme ***"
- Not enough memory is available to complete this request
- You third iOS app,解决1The identity used to sign the executable is no longer valid 2.A valid provisioning profile for this executable was not found。