Azure / Azure/azure-functions-host
[BUG] 403 Forbidden errors when Azure Function connects to AzureWebJobsStorage account with private endpoint
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
# Issue Transfer
This issue has been transferred from the Azure SDK for .NET repository, [#38185](https://github.com/Azure/azure-sdk-for-net/issues/38185).
### Please be aware that @sethcrichton is the author of the original issue and include them for any questions or replies.
## Details
### Describe the bug
We control access to the storage accounts in our environment using private endpoints that are on the same vnet as our deployed Azure function applications. For all of our existing functions (Event hub trigger, timer trigger, etc.), this has worked without issue.
We are creating a new function that implements a blob trigger. **The trigger itself can connect to the storage account without issue, but the connection used by the underlying web jobs runtime (using the AzureWebJobsStorage setting) is failing with a 403 Forbidden exception.**
### Expected behavior
Storage connection is established and the function runs as expected.
### Actual behavior
Azure.Storage.Queues: This request is not authorized to perform this operation.
Status: 403 (This request is not authorized to perform this operation.)
ErrorCode: AuthorizationFailure
### Reproduction Steps
Deploy function with blob trigger to Azure (AKS/container deployment)
Wait for function to start up.
Observe that the function fails to start due to the storage connection issue.
(note that this can also be replicated running the function locally on a developer workstation)
### Environment
.NET version: 6.0
Functions version: v4
AKS version: 1.25.6
Visual Studio version: 17.6.0
Contributor guide
Research direction
No source file or test is identified. Start at the Azure Functions host startup path for a blob trigger and the AzureWebJobsStorage connection, then reproduce the 403 in the listed AKS or local environments. Done means the host establishes the storage connection and the function starts as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, kubernetes
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100