Forum Discussion

AugustoJaba's avatar
AugustoJaba
Copper Contributor
Dec 18, 2024

Troubleshooting Azure Function App Proxy with Private Blob Container Access for Static Web App

Recently, I shared a problem I’m facing in my testing environment with a friend. I’ve decided to bring this issue to an open forum discussion to gather additional insights. I hope you can help me figure out what might be missing in my configuration.

**Context:**
I’m trying to replicate a solution in my test environment but encountering difficulties in a specific scenario.

**Scenario:**
I have a Function App acting as a proxy for a Static Web App hosted in a Blob Container. This Blob Container is set to private access, meaning public access is disabled.

**The Problem:**
The goal is for my Function App to authorize users and direct them correctly to the Static Web App. However, it’s not working as expected.

**What I’ve tried so far:**
1. Configured Managed Identity for the Function App and granted the necessary permissions to the Blob Container.
2. Properly set up authentication and created the App Registration, which works flawlessly.
3. Verified that the proxy functions correctly when the Blob Container’s public access is enabled.

**Current behavior:**
- When public access to the Blob Container is enabled, everything works fine.
- When public access is disabled, even with the proxy configured, access fails, and an error message "resource not found" is returned.

**My questions are:**
1. Do I need to configure something additional in the proxy definition file?
2. Is there a specific setting, like a private endpoint or something similar, that I should implement to resolve this issue?

**Additional considerations:**
I haven’t configured a private endpoint yet, but I’m considering whether this would be the most appropriate solution for my case. My initial expectation was that granting the necessary permissions to the Function App via Managed Identity would solve the issue, but it hasn’t.

I appreciate any guidance or suggestions you can provide!

 

api management
App Services
azure
Azure Essentials
Azure Friday
Azure Stack
Data + Storage
devops
Networking
Static Web Apps
  • balasubramanim's avatar
    balasubramanim
    Iron Contributor
    Dec 19, 2024

    AugustoJaba 

     

    Please try the below approcah.

     

    1. Check Permissions - Ensure the Function App's Managed Identity has the Storage Blob Data Reader or Contributor role on the Blob Container.

    2. Update Proxy Config - Confirm the proxy proxies.json correctly points to the private Blob Container. 
    {
      "route": "/static/{*path}",
      "backendUri": "https://<storageaccount>.blob.core.windows.net/<container>/{path}"
    }

    3. Private Endpoint - If Blob access is blocked, create a Private Endpoint for the Blob Storage. Integrate the Function App with the same virtual network and configure private DNS to resolve Blob URLs.

    4. Test Access - Use Managed Identity to verify the Function App can list Blob contents.
    Example
    from azure.storage.blob import BlobServiceClient
    from azure.identity import ManagedIdentityCredential
    # Use Managed Identity to access storage

    5. Enable Logs - Check logs for errors in Function App and Blob Storage to troubleshoot further.

    This setup should enable secure access while keeping your Blob Container private.

Resources