Storage networking: firewall, service endpoints, private endpoints

Load the names you need and start web01:

$st = (Get-Content C:\azure-lab\storage.txt)
$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
$id = az storage account show --resource-group rg-saat-data --name $st --query id -o tsv
az vm start --resource-group rg-saat-vms --name web01

1Baseline: what web01 sees today

Ask web01 to resolve the blob endpoint and make an anonymous request:

az vm run-command invoke --resource-group rg-saat-vms --name web01 --command-id RunShellScript --scripts "getent hosts $st.blob.core.windows.net; curl -sS https://$st.blob.core.windows.net/lab/hello.txt | grep -o '<Code>[A-Za-z]*</Code>'" --query "value[0].message" -o tsv

You should see something like this:

[stdout]
20.60.x.x   blob.pnq21prdstr05a.store.core.windows.net stsaat48213.blob.core.windows.net
<Code>PublicAccessNotPermitted</Code>

A public IP, and an answer from storage itself: the network let the request in, and the account refused anonymous access. That second line is how this lab tells “network OK” from “network blocked” without any keys.

2Turn on the firewall with a service endpoint

Add your laptop’s public IP first, so you don’t lock yourself out, then allow snet-web and deny everything else:

$ip = Invoke-RestMethod -Uri https://api.ipify.org
az network vnet subnet update --ids $v.'snet-web' --service-endpoints Microsoft.Storage -o none
az storage account network-rule add --resource-group rg-saat-data --account-name $st --ip-address $ip -o none
az storage account network-rule add --resource-group rg-saat-data --account-name $st --subnet $v.'snet-web' -o none
az storage account update --resource-group rg-saat-data --name $st --default-action Deny -o none
az storage account show --resource-group rg-saat-data --name $st --query "{default:networkRuleSet.defaultAction, ips:length(networkRuleSet.ipRules), subnets:length(networkRuleSet.virtualNetworkRules)}" -o table
az vm run-command invoke --resource-group rg-saat-vms --name web01 --command-id RunShellScript --scripts "getent hosts $st.blob.core.windows.net; curl -sS https://$st.blob.core.windows.net/lab/hello.txt | grep -o '<Code>[A-Za-z]*</Code>'" --query "value[0].message" -o tsv

You should see something like this:

Default    Ips    Subnets
---------  -----  ---------
Deny       1      1
[stdout]
20.60.x.x   blob.pnq21prdstr05a.store.core.windows.net stsaat48213.blob.core.windows.net
<Code>PublicAccessNotPermitted</Code>

web01 still gets through: the VNet rule matches its subnet through the service endpoint. The IP rule is for your laptop; it would do nothing for web01, because IP rules ignore same-region traffic.

3Create a private endpoint for blob

Put it in snet-data and give it a private DNS zone linked to vnet-saat:

$vnetId = az network vnet show --resource-group rg-saat-core --name vnet-saat --query id -o tsv
az network private-endpoint create --resource-group rg-saat-data --name pe-saat-blob --location centralindia --subnet $v.'snet-data' --private-connection-resource-id $id --group-id blob --connection-name pec-saat-blob --tags course=saatvedha-azure lesson=26 -o none
az network private-dns zone create --resource-group rg-saat-data --name privatelink.blob.core.windows.net --tags course=saatvedha-azure lesson=26 -o none
az network private-dns link vnet create --resource-group rg-saat-data --zone-name privatelink.blob.core.windows.net --name link-vnet-saat --virtual-network $vnetId --registration-enabled false -o none
az network private-endpoint dns-zone-group create --resource-group rg-saat-data --endpoint-name pe-saat-blob --name default --private-dns-zone privatelink.blob.core.windows.net --zone-name blob -o none
az network private-dns record-set a list --resource-group rg-saat-data --zone-name privatelink.blob.core.windows.net --query "[].{name:name, ip:aRecords[0].ipv4Address, ttl:ttl}" -o table

You should see something like this:

Name         Ip         Ttl
-----------  ---------  -----
stsaat48213  10.30.3.4  10

The zone group wrote the A record for you, and will remove it if the endpoint is deleted. 10.30.3.4 is the first usable address in snet-data.

4Switch off public access and test again

Run this:

az storage account update --resource-group rg-saat-data --name $st --public-network-access Disabled -o none
az vm run-command invoke --resource-group rg-saat-vms --name web01 --command-id RunShellScript --scripts "getent hosts $st.blob.core.windows.net; curl -sS https://$st.blob.core.windows.net/lab/hello.txt | grep -o '<Code>[A-Za-z]*</Code>'" --query "value[0].message" -o tsv

You should see something like this:

[stdout]
10.30.3.4       stsaat48213.privatelink.blob.core.windows.net stsaat48213.blob.core.windows.net
<Code>PublicAccessNotPermitted</Code>

Same name, private IP, and storage still answers. The account now has no public door at all; only the private endpoint reaches it.

✅ Checkpoint: web01 resolves the account to 10.30.3.4 and reaches it, and public network access is Disabled.