Azure / Azure/azure-functions-host

[BUG] 403 Forbidden errors when Azure Function connects to AzureWebJobsStorage account with private endpoint

Open
#9,496 8 comments 1 reaction 0 assignees View on GitHub
needs-investigation
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

# Issue Transfer

This issue has been transferred from the Azure SDK for .NET repository, [#38185](https://github.com/Azure/azure-sdk-for-net/issues/38185).

### Please be aware that @sethcrichton is the author of the original issue and include them for any questions or replies.

## Details

### Describe the bug

We control access to the storage accounts in our environment using private endpoints that are on the same vnet as our deployed Azure function applications. For all of our existing functions (Event hub trigger, timer trigger, etc.), this has worked without issue.

We are creating a new function that implements a blob trigger. **The trigger itself can connect to the storage account without issue, but the connection used by the underlying web jobs runtime (using the AzureWebJobsStorage setting) is failing with a 403 Forbidden exception.**

### Expected behavior

Storage connection is established and the function runs as expected.

### Actual behavior

Azure.Storage.Queues: This request is not authorized to perform this operation.
Status: 403 (This request is not authorized to perform this operation.)
ErrorCode: AuthorizationFailure

### Reproduction Steps

Deploy function with blob trigger to Azure (AKS/container deployment)
Wait for function to start up.
Observe that the function fails to start due to the storage connection issue.

(note that this can also be replicated running the function locally on a developer workstation)

### Environment

.NET version: 6.0
Functions version: v4
AKS version: 1.25.6

Visual Studio version: 17.6.0

Contributor guide

Open the contributing guide

Research direction

No source file or test is identified. Start at the Azure Functions host startup path for a blob trigger and the AzureWebJobsStorage connection, then reproduce the 403 in the listed AKS or local environments. Done means the host establishes the storage connection and the function starts as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, kubernetes
Domain
backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.