How can I successfully limit the scope of allowed access to an Azure StorageAccount to a specified DatabaseServer?
I want to enable Audit logs on a database server in Azure [documentation]. I am using the Java client, however, this can be replicated using the REST API as well.
In Azure, I have a database server for which I'm running this call. I also have a StorageAccount already setup that should receive the logs. Using either the Java client or the REST API, I've given the appropriate parameters pointing to the storage account and I always get the response:
com.microsoft.azure.CloudException: com.microsoft.azure.CloudException: Async operation failed with provisioning state: Failed: Insufficient read or write permissions on the provided storage account.
In Azure Portal, under the storage account -> Firewall rules, if I choose Allow access from all networks then everything works perfectly.
Opening up access to all networks, however, is too wide and I'd like to limit access to just the database server. I have tried the following:
- From the FirewallRules section of the StorageAccount, under
Selected networksI have tried choosing the subnet that the DBServer belongs to. This does not help and produces the same error. - From the FirewallRules section of the StorageAccount, under
Add IP ranges to allow access from the internet or your on-premises networksI have added the IP of the DB server directly. This produces the same error.
What IP do I need to whitelist or what do I need to do in order for only the DB server to have write permissions on the StorageAccount?
Edit for further information:
I have continued to try and get this working. Per the answer below, I've whitelisted every single IP for datacenters in the region I'm working with. No dice. I have also previously attempted to whitelist the VNet that the DBServer is a part of, no dice.
Also, I've tried manually to switch on the Audit logs in Azure Portal and assign the the log output the the created StorageAccount and it fails with this error:
Failed to save Auditing settings for server: test-p1-server. ErrorMessage: The storage account 'blahblahblah' is behind a firewall or in a virtual network. Please choose a storage account without any firewall rules or virtual network configurations.
This error states explicitly that I need a storage that has no firewall and no restrictions... The answer seems obvious, shut off the firewall. That, however, is not an option as the security guys would flay me alive and roast my tasty bits.