Scenario:
I need to copy blobs from a storage account container into an Azure File Share in another storage account.
The storage accounts are in different spoke subscriptions in a hub-spoke architecture.
It will be done with an Azure Runbook.
This can be done with azcopy like so:
azcopy copy "https://source.blob.core.windows.net/blobs/myBlob?<SAS>" "https://destination.file.core.windows.net/fileshare/myBlob.txt.bak?<SAS>"
However this traffic goes over the public internet which is not suitable for this scenario. Very sensitive data.
I was thinking of enabling private endpoints, but as I understand this is for scenarios where something inside the VNET needs private access to the storage account, for example a VM. Not storage account -> storage account connectivity. AzCopy will still use the internet.
So the question is: Is there any way to copy files from one storage account to another using the VNETs in Azure or using the Microsoft backbone network? Copy from VM to VM is not desired.
EDIT:
Maybe it's possible to specify the private URL with azcopy and as such uses the DNS of the private endpoint? However as you need to specify whether this endpoint is for blob OR files it might not work (storage subresource). Gonna try this option tomorrow.
source.privatelink.blob.core.windows.net
destination.privatelink.file.core.windows.net