"CloudException: ... Insufficient read or write permissions on the provided storage account." when enabling DBServer audit logs in Azure

Viewed 1417

How can I successfully limit the scope of allowed access to an Azure StorageAccount to a specified DatabaseServer?

I want to enable Audit logs on a database server in Azure [documentation]. I am using the Java client, however, this can be replicated using the REST API as well.

In Azure, I have a database server for which I'm running this call. I also have a StorageAccount already setup that should receive the logs. Using either the Java client or the REST API, I've given the appropriate parameters pointing to the storage account and I always get the response:

com.microsoft.azure.CloudException: com.microsoft.azure.CloudException: Async operation failed with provisioning state: Failed: Insufficient read or write permissions on the provided storage account.

In Azure Portal, under the storage account -> Firewall rules, if I choose Allow access from all networks then everything works perfectly.

Opening up access to all networks, however, is too wide and I'd like to limit access to just the database server. I have tried the following:

  • From the FirewallRules section of the StorageAccount, under Selected networks I have tried choosing the subnet that the DBServer belongs to. This does not help and produces the same error.
  • From the FirewallRules section of the StorageAccount, under Add IP ranges to allow access from the internet or your on-premises networks I have added the IP of the DB server directly. This produces the same error.

What IP do I need to whitelist or what do I need to do in order for only the DB server to have write permissions on the StorageAccount?

Edit for further information:

I have continued to try and get this working. Per the answer below, I've whitelisted every single IP for datacenters in the region I'm working with. No dice. I have also previously attempted to whitelist the VNet that the DBServer is a part of, no dice.

Also, I've tried manually to switch on the Audit logs in Azure Portal and assign the the log output the the created StorageAccount and it fails with this error:

Failed to save Auditing settings for server: test-p1-server. ErrorMessage: The storage account 'blahblahblah' is behind a firewall or in a virtual network. Please choose a storage account without any firewall rules or virtual network configurations.

This error states explicitly that I need a storage that has no firewall and no restrictions... The answer seems obvious, shut off the firewall. That, however, is not an option as the security guys would flay me alive and roast my tasty bits.

2 Answers

I have found the answer to this (Direct from Microsoft Azure Support).

At this time, DB/DBServer Audit Logs does not support an Azure StorageAccount that has firewall rules enabled because the DBServer cannot be whitelisted on the StorageAccount's firewall.

The StorageAccount (behind the scenes) has a dynamic IP that is not know to us and changes often and therefore cannot be whitelisted. Other Microsoft services get around this by using the feature "Allow trusted Microsoft services to access this storage account." Auditing logs, however, is not one of the services that is affected by this feature.

For reference, here are the allowed services: Allowed services

  • Azure Backup
  • Azure Data Box
  • Azure Event Grid
  • Azure DevTest Labs
  • Azure Event Hubs
  • Azure Monitor
  • Azure Networking Azure Site Recovery
  • Azure SQL Data Warehouse
  • Azure HDInsight

More info:

Related