Whitelisting Runbook IP on Storage Account

Keagan Kennedy 5 Reputation points
2024-09-04T07:14:28.03+00:00

Hello, I have a script which writes a CSV to a Storage account. The storage account only allows specific IPs on the whitelist to access it. So in my script I have the command Add-AzStorageAccountNetworkRule and before that I am curling http://ifconfig.me/ip

I have tested the Add-Azstorageaccountnetworkrule on my local machine and before using it I can't access and after I use it I can which is how it should be no problem works fine.
However in the runbook script I curl my public ip then I add it however I still get a Error 403 seen in the image I have put. All help is appreciated.
I am using a system assigned managed identity for the automation account/runbook and it has Storage blob data contributor and storage account contributorUser's image

Azure Automation
Azure Automation
An Azure service that is used to automate, configure, and install updates across hybrid environments.
1,257 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,575 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nehruji R 8,066 Reputation points Microsoft Vendor
    2024-09-04T12:57:59.5+00:00

    Hello Keagan Kennedy,

    Greetings! Welcome to Microsoft Q&A Platform.

    A 403-status code typically signifies that the request was understood by the server, but the server is refusing to authorize it. It suggests that the authorization configuration might be inconsistent or that there are intermittent issues with the Azure service or your network.

    If your application is using tokens for authorization, the tokens may be expiring or not being refreshed properly, leading to occasional failures.

    • If the issue is related to a storage account which I presume, try regenerating the storage account access keys and updating your application with the new keys.
    • Ensure that the service principal or managed identity running the automation script has the Storage Blob Data Contributor role assigned.
    • Ensure that any access policies set on the storage account or specific containers allow the necessary operations.
    • Make sure your script is using the correct API version that supports the operations you’re trying to perform.

    Also, it will occur if the Azure Automation account is unable to access the storage account due to network restrictions. When network access is limited to selected virtual networks and IP addresses, we need to add the public IP of the Automation Account to the storage account’s network settings.

    If the Automation account has a static IP address, you can add this IP to the list of allowed IP addresses in the storage account’s network settings.

    If the IP address is not static, you may need to allow the entire IP range for the Azure region where your Automation account is located. This not always ideal, but is a potential solution to the issue.

    Also, to verify that no network or firewall rules are blocking the connection. You might need to allow access from all networks temporarily to test if this resolves the issue.

    when restricting network access to storage account, you will not be able to access if Azure Automation service isn't part of your trusted services registered within Azure subscription.

    In order to achieve your requirement, I would suggest you use Hybrid Worker to execute the runbook so that you can restrict the access to the storage account.

    refer https://video2.skills-academy.com/en-us/troubleshoot/azure/azure-storage/blobs/alerts/troubleshoot-storage-client-application-errors?tabs=dotnet ,https://techcommunity.microsoft.com/t5/azure-paas-blog/troubleshooting-the-403-error-for-user-delegation-sas-in-azure/ba-p/3294999 for more troubleshooting.

    Hope this answer helps! please let us know if you have any further queries. I’m happy to assist you further.

    Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.