Allowing trusted Azure services to bypass Storage Account network rules

Question

Pulumi · Accepted Answer

In Azure, you can configure network rules for storage accounts to restrict access to them. However, there might be scenarios where you need trusted Azure services to interact with these storage accounts even when network restrictions are in place. To allow trusted Azure services to bypass network rules, you utilize the "exception" settings in the storage account configuration.

Below is a Pulumi program written in TypeScript that demonstrates how to set up a Storage Account with a network rule that allows access from trusted Microsoft Azure services. This is done by setting the `bypass` property to include `AzureServices` in the network rules configuration.

The program uses the `azure-native` provider to create a new resource group and a storage account with the modified network rules.

Before diving into the code, ensure you have the following prerequisites ready:
- Pulumi CLI installed and configured with Azure.
- Authenticated to your Azure account where you want to create the resources.

Here's the detailed Pulumi TypeScript program:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

// Create an Azure Resource Group
const resourceGroup = new azure_native.resources.ResourceGroup("myResourceGroup");

// Create a Storage Account with network rules that allow traffic from trusted Azure services
const storageAccount = new azure_native.storage.StorageAccount("myStorageAccount", {
  resourceGroupName: resourceGroup.name,
  location: resourceGroup.location,
  sku: {
    name: azure_native.storage.SkuName.Standard_LRS
  },
  kind: azure_native.storage.Kind.StorageV2,
  networkRuleSet: {
    bypass: "AzureServices", // Bypassing network rules for trusted Azure services
    defaultAction: "Deny",   // By default, deny all other network access
    ipRules: [],             // Here you could specify an array of IP rules if needed
    virtualNetworkRules: []  // Here you could specify an array of virtual network rules if needed
  }
});

// Export the connection string for the storage account
export const connectionString = pulumi.interpolate`DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount.primaryAccessKey};EndpointSuffix=core.windows.net`;

```

This program sets up the `networkRuleSet` of the storage account with the `bypass` option set to "AzureServices". This effectively tells the storage account to allow trusted Microsoft services to access your storage account while denying all other traffic by default. The `defaultAction` is set to "Deny", meaning only the sources specified in the network rule set and the trusted Microsoft services can access the storage account. The `ipRules` and `virtualNetworkRules` arrays are left empty in this example, but you can populate them with specific IP addresses or virtual networks that are allowed to access your storage account.

Finally, the program exports the connection string that you can use to access the storage account from your applications, once the deployment is successful. This value is sensitive and should be handled securely.

Remember to never hard-code your Azure credentials or any secrets in your Pulumi programs. Always use Pulumi configuration, environment variables, or managed identity for authentication.