Azure / Azure/azure-powershell

[Az.Storage] New created storage account might fail to enable public access on blob container (Set-AzStorageContainerAcl)

Open
#22,360 1 comment 0 reactions 1 assignee Claimed by @blueww View on GitHub
act-codegen-extensibility-squad External Storage
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Beginning August 2023, New created storage account without set parameters "-AllowBlobPublicAccess $true" might will fail to enable public access on container.

This is caused by a Storage server change:
Beginning August 2023, Azure storage will begin phased roll out of changes that disables anonymous access and cross tenant replication for all new storage accounts by default, to align with best practices for security and reduce the risk of data exfiltration.
See more details in [Blog Post](https://techcommunity.microsoft.com/t5/azure-storage-blog/azure-storage-updating-some-default-security-settings-on-new/ba-p/3819554).

User can identify this issue, by run `Set-AzStorageContainerAcl` and see the error code from server is `PublicAccessNotPermitted`.

### Module versions
All Az.Storage module versions will be impacted.
(The change will impact all API versions. So both released Az.Storage module and coming Az.Storage module will be impacted.)

### Issue script & Debug output

```PowerShell
PS > $account = New-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -SkuName Standard_LRS -Location $location
PS > $ctx = $account.Context
PS > New-AzStorageContainer -Context $ctx -Name $containerName
PS > Set-AzStorageContainerAcl -Context $ctx -Name $containerName -Permission Blob
Set-AzStorageContainerAcl : Public access is not permitted on this storage account.
RequestId:dcf1634b-701e-0000-5b5e-b98409000000
Time:2023-07-18T10:00:39.9193620Z
Status: 409 (Public access is not permitted on this storage account.)
ErrorCode: PublicAccessNotPermitted
Content:
PublicAccessNotPermittedPublic access is not permitted on this storage account.
RequestId:dcf1634b-701e-0000-5b5e-b98409000000
Time:2023-07-18T10:00:39.9193620Z
Headers:
x-ms-request-id: dcf1634b-701e-0000-5b5e-b98409000000
x-ms-client-request-id: 4705b40f-158a-4e5e-bac8-3ffc403dc2e9
x-ms-version: 2022-11-02
x-ms-error-code: PublicAccessNotPermitted
Content-Length: 248
Content-Type: application/xml
Date: Tue, 18 Jul 2023 10:00:39 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
At line:1 char:1
+ Set-AzStorageContainerAcl -Context $ctx -Name src -Permission Blob
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Set-AzStorageContainerAcl], RequestFailedException
+ FullyQualifiedErrorId : RequestFailedException,Microsoft.WindowsAzure.Commands.Storage.Cmdlet.SetAzureStorageContainerAclCommand
```

### WorkAround
For new Storage Account, users can workaround it by set `-AllowBlobPublicAccess $true` in create storage account.
Set to true if required. Otherwise, we recommend setting it to false to follow best security practices
```PowerShell
New-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -SkuName Standard_LRS -Location $location -AllowBlobPublicAccess $true
```
For existing Storage Account, users can workaround it by updating storage account with `-AllowBlobPublicAccess $true`.
Set to true if required. Otherwise, we recommend setting it to false to follow best security practices
```PowerShell
Set-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -AllowBlobPublicAccess $true
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.