azure - 如何保护 Azure Functions 后端存储帐户的安全？

Question

我已经创建了一个 Azure 存储帐户，其中包含 blob、文件、表和队列的专用终结点。为了安全起见，我已将“公共(public)网络访问”设置为“允许可信服务列表上的 Azure 服务访问此存储帐户”。

但是，除非打开“公共(public)网络访问”，否则 Azure Function 创建(通过门户)将会失败。

除了在存储上启用公共(public)网络访问之外，还有更好的方法吗？

我已检查以下链接，没有任何内容表明存储需要公开访问。 https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli

错误:

"properties": {
    "statusCode": "BadRequest",
    "serviceRequestId": null,
    "statusMessage": "{\"Code\":\"BadRequest\",\"Message\":\"Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.\",\"Target\":null,\"Details\":[{\"Message\":\"Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.\"},{\"Code\":\"BadRequest\"},{\"ErrorEntity\":{\"ExtendedCode\":\"99022\",\"MessageTemplate\":\"Creation of storage file share failed with: '{0}'. Please check if the storage account is accessible.\",\"Parameters\":[\"The remote server returned an error: (403) Forbidden.\"],\"Code\":\"BadRequest\",\"Message\":\"Creation of storage file share failed with: 'The remote server returned an error: (403) Forbidden.'. Please check if the storage account is accessible.\"}}],\"Innererror\":null}",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/XXXXXXXXXXXX/resourcegroups/rg-xxxxxxx/providers/Microsoft.Web/sites/func-xxxxxxx",
    "message": "Microsoft.Web/sites/write",
    "hierarchy": "xxxxx/MG/MG/xxxxxx"
}

Answer 1

查找function app's outbound IP addresses和 grant access from an internet IP range到那些IP地址。如果您的函数应用集成了 VNET，grant access from a virtual network .