docs: document workaround for static website properties 404 on private storage accounts - #301
Open
Brian Gordon Davis (bgdnext64) wants to merge 1 commit into
Open
Conversation
Copilot started reviewing on behalf of
Brian Gordon Davis (bgdnext64)
August 4, 2026 16:41
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation for a Terraform/azurerm behavior where reading static website properties can fail with a misleading 404 when analyzing private (network-restricted) Azure Storage Accounts, clarifying that this is a data-plane network reachability issue rather than an RBAC permissions gap.
Changes:
- Documented the “retrieving static website properties for Storage Account” 404 scenario in Known Issues.
- Explained root cause (data-plane call via the storage account endpoint subject to network rules/private endpoints).
- Added workarounds for running analysis from a reachable network location or temporarily allowing public access during analysis.
| Storage Account Name: "saexample"): executing request: unexpected status 404 (404 The specified resource does not exist.) with ResourceNotFound: The specified resource does not exist. | ||
| ``` | ||
|
|
||
| Setting and retrieving static website properties uses the Storage [data plane API](https://github.com/hashicorp/terraform-provider-azurerm/issues/24982#issuecomment-1972246655), which is served from the storage account's own endpoint. That endpoint is subject to the same network access restrictions as the account itself, so when the account has a private endpoint or its network rules deny public access, the request is only reachable from a network location that can resolve and reach the private endpoint. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Known Issues entry documenting the
retrieving static website properties for Storage Account404 error that can occur when analyzing private storage accounts with Terraform.The static website properties are read through the Storage data plane API served from the storage account's own endpoint, so the call is subject to the account's network restrictions. When a private endpoint or deny-by-default network rules are in place, the request is only reachable from within the account's network. Because the failure is a network reachability issue rather than a missing-permission (control-plane authorization) error, the utility cannot infer or append any RBAC permission to resolve it, so a documented workaround is the appropriate fix.
The new section explains the root cause and gives two workarounds: run the utility from a network location that can reach the private endpoint, or temporarily allow public access during analysis.
Fixes #47