Hi, Below is my steps: Create Storage account. Create Azure front door link to Storage Blob as origin enable private link go to Storage Account, Networking approved Private Endpoint connections. After approved wait for few minutes, but when I tried to use front door navigate to my blobs it return My container access level May I know am I did something wrong in between ? Thanks, Regards, Chin Yeow

@ets Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to leverage Azure Front Door Premium storage account origin with Private Link Apologies for the delay, as I was deploying a Lab. Your configuration steps are correct. It is just that we overlooked the "Change Access level " property of the Storage Account. Refer : Configure anonymous public read access for containers and blobs The "Private" does not mean access is restricted to only Private IPs In fact, this setting does not influence the networking part at all (atleast, not at HTTP level) It actually means access is only provided for "Authorized requests". No public read access: The container and its blobs can be accessed only with an authorized request. This option is the default for all new containers. Network Access is actually controlled and provided to the Storage Account as a whole. Refer : Allow or disallow public read access for a storage account Now, for your case, you must either use a Shared Key (storage account key) or Shared access signature (SAS) We can actually test this, Just by using Storage Account. Set the "Change Access level" to Private Try to access the blob in the container, you should see 404 - which is expected. Now, with the Access Level still as private, use a shared access signatures (SAS) and make the requests with it You will see, even with "Change Access level" to Private, you will be able to access it via Internet So, this means, your request will become something like, https:// <StorageAccountName> .blob.core.windows.net***/private/index.html***? <SASToken> And subsequently, your AFD request becomes, https:// <AFDEndPointName> .azurefd.net***/private/index.html***? <SASToken> Please let us know if we can be of any further assistance here. Thanks, Kapil Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Azure Front End with Origin Storage (Azure Blobs) with Enable Private Link Service not working

ets 0

Hi,

Below is my steps:

Create Storage account.
Create Azure front door link to Storage Blob as origin enable private link

User's image

go to Storage Account, Networking approved Private Endpoint connections.
After approved wait for few minutes, but when I tried to use front door navigate to my blobs it return

User's image

My container access level

User's image

May I know am I did something wrong in between ?

Thanks,

Regards,

Chin Yeow

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-25T06:24:24.7+00:00
@ets

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to leverage Azure Front Door Premium storage account origin with Private Link

Your configuration steps looks good.

However, I suspect that this is an issue with the Storage Account itself and not the AFD.

Since you have created a Private endpoint in a VNET,

Did you try to access the blob via a VM in the same subnet/VNet as the Private EndPoint?

If not, please deploy a dummy VM in the same subnet and try to access the PE.

You can use host files to map the PE IP to the domain of the storage account FQDN.

Can you please verify if this works?

Should this work, we can further troubleshoot for Origin

Cheers,

Kapil
ets 0 Reputation points

2023-08-25T07:02:17.8933333+00:00

Hi,

I don't understand about this line Since you have created a Private endpoint in a VNET

What I did is created a Front door with private link and link with Origin Storage blob. May I know how I going to know what is my subnet for my blob ?

Thanks,

Regards,

CY
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-25T07:18:33.6066667+00:00
@ets

Apologies.

Yes, the PE would not have been associated with any VNET in case it was created from the Front Door.

Is it possible if you could create a new Private EndPoint in a VNet and test the access?

Using a testVM and private IP of the PE

Also, does direct public access (bypassing the AFD) of the blob using Storage Account's FQDN work?

Cheers,

Kapil
ets 0 Reputation points

2023-08-25T07:23:34.74+00:00

Hi,

I created and delete multiple front door to test, same result.

May I know how to Using a testVM and private IP of the PE ?

direct public access (bypassing the AFD) of the blob using Storage Account's FQDN work - Yes, this work fine.

I tested with new FD with Private Link, same result reousecenotfound.

Thanks,

Regards,

CY
ets 0 Reputation points

2023-08-25T07:25:57.6233333+00:00

Hi,

May I know if I created a private link on AFD and link to Azure storage blob. Can I access from public access or cannot ? If cannot, how I going to access it.

Thanks,

Regards,

CY
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-29T04:58:28.7966667+00:00

@ets

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-30T06:33:09.7+00:00

@ets

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-31T09:16:26.7166667+00:00

@ets

Could you please provide an update on this post?

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

1 answer

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-25T13:33:43.7333333+00:00
@ets

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to leverage Azure Front Door Premium storage account origin with Private Link

Apologies for the delay, as I was deploying a Lab.

Your configuration steps are correct. It is just that we overlooked the "Change Access level " property of the Storage Account.

Refer : Configure anonymous public read access for containers and blobs

The "Private" does not mean access is restricted to only Private IPs

In fact, this setting does not influence the networking part at all (atleast, not at HTTP level)

It actually means access is only provided for "Authorized requests".

No public read access: The container and its blobs can be accessed only with an authorized request. This option is the default for all new containers.

Network Access is actually controlled and provided to the Storage Account as a whole.

Refer : Allow or disallow public read access for a storage account

Now, for your case, you must either use a

Shared Key (storage account key) or

Shared access signature (SAS)

We can actually test this, Just by using Storage Account.

Set the "Change Access level" to Private

Try to access the blob in the container, you should see 404 - which is expected.

Now, with the Access Level still as private, use a shared access signatures (SAS) and make the requests with it

You will see, even with "Change Access level" to Private, you will be able to access it via Internet

So, this means, your request will become something like,

https://<StorageAccountName>.blob.core.windows.net***/private/index.html***?<SASToken>

And subsequently, your AFD request becomes,

https://<AFDEndPointName>.azurefd.net***/private/index.html***?<SASToken>

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.
ets 0 Reputation points

2023-08-28T02:10:00.0066667+00:00

Hi Kapil,

You mean even with private link I still need to provide sas token ?

If I change to public for the container level and use it with private link , will it mean anonymous can access from internet ?

Thanks,

Regards,

Chin Yeow

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-08-28T09:21:08.9266667+00:00

@ets,

You mean even with private link I still need to provide sas token ?

If you have the container access level as "Private" , then you must provide the SAS Token even with Private Link

In case you have the container access level as "Public" , then SAS token is not required.

If I change to public for the container level and use it with private link , will it mean anonymous can access from internet ?

Yes, this is correct.

To restrict network access, you should consider using the Firewall settings at the Storage Account level.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Modou Diouf 0 Reputation points

2024-02-21T11:48:04.0933333+00:00

Hi KapilAnanth-MSFT
Finally what is the utility of the PrivateLink of Azure Front door ?
Does azure front door support managed identity for azure storage account ?

Thanks !

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2024-02-26T04:23:03.7233333+00:00

Modou Diouf ,

Greetings.

Wrt,

1.Finally what is the utility of the PrivateLink of Azure Front door ?

Azure Front Door Premium can connect to your origin using Private Link.

Your origin can be hosted in a virtual network or hosted as a PaaS service such as Azure Web App or Azure Storage.

Private Link removes the need for your origin to be accessed publicly.

2.Does azure front door support managed identity for azure storage account ?

From this list : Services supporting managed identities , I don't see AFD.

Hence, I don't think AFD would support managed identities.

Cheers,

Kapil

Modou Diouf 0 Reputation points

2024-02-26T06:34:53.5233333+00:00

Hi KapilAnanth-MSFT
Thanks for your answers.
When i use Azure blob storage as azure front door origin, it's required to enable blob public acces even if the front door will not join the blob.

Have you another solution, that allow me to not configure blob origin with public access ?

Thanks !

Tchimwa Sougang 936 Reputation points Microsoft Employee

2024-02-26T06:51:08.55+00:00

@Modou Diouf As of now there is no other solution as it is a requirement. Something that you have to remember is the fact that you can disable the public access on the Azure Storage networking firewall configuration totally. So that only the Front Door will be able to access it via private link.

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2024-02-26T11:47:20.6733333+00:00

Modou Diouf ,

The concept of using Private Link with AFD is to avoid providing public access to the PaaS Service as mentioned by Tchimwa Sougang.

Cheers,

Kapil
Sign in to comment

Share via

Azure Front End with Origin Storage (Azure Blobs) with Enable Private Link Service not working

1 answer