Discussion on: Azure Function App (Flex Consumption) in private VNET via IaC

[Yuriy Magurdumov]

I have two questions regarding Azure Function App access to a storage account using system-assigned managed identity and RBAC:

1. Public Storage Account:

   • A Flex Consumption Function App uses a system-assigned managed identity to access a public storage account (no storage account keys).
   • Azure infrastructure successfully uses this storage account for app package deployment (blob service) and content access (file shares).
   • Question: Can the function app code itself programmatically access the same storage account using the system-assigned managed identity?

2. Private VNet and Storage Account:

   • Same scenario as above, but the storage account is now within a private virtual network (VNet).
   • Question: Does the addition of a private VNet change whether the function app code can programmatically access the storage account?

Essentially, I'm trying to understand the scope of the system-assigned managed identity's access from within the function app's execution environment.

[Roman Kiprin]

These are pretty good questions!

From the Azure Function code perspective, it does not matter which storage account you use. The access operations will be the same.

Here is the PowerShell code:

# Connect to Microsoft Azure
Connect-AzAccount  -Identity

# Create a context object using Entra ID credentials
$ctx  =  New-AzStorageContext  -StorageAccountName $saName  -UseConnectedAccount

# Get a list of all containers
$containers  =  Get-AzStorageContainer  -Context $ctx

Here is a link to the code in repo

To perform a login, just use the "-Identity" flag, which will pick up the managed identity.

So, the first answer is definitely yes.

The second one...

There are complications related to the DNS name of the storage account. Microsoft uses ".blob.core.windows.net" DNS zone for the blob service of publicly available storage accounts, ".file.core.windows.net" for file service, and so on.

Your request to st0rag3acc0unt.blob.core.windows.net will be resolved to a publicly accessible IP address via public DNS.

When you make your storage account private, you will have to create a private endpoint for every service in use: blob, file, queue, table...

And then, you will have to create a private DNS zone for every service and record the storage account name in this private DNS zone.

Basically, your record in the private DNS zone should resolve the same name, "st0rag3acc0unt.blob.core.windows.net" to the private IP address of the private endpoint.

All of that means your function app code will not have any clue that it's working with a private service. And that is exactly how the function app works in my example.

Therefore, the answer is no, it does not. (However, to make it working smoothly, you will have to put some efforts to building that DNS and network infrastructure.)