This sample Azure Resource Manager template deploys an Azure Function App that communicates with the Azure Storage account referenced by the AzureWebJobsStorage and WEBSITE_CONTENTAZUREFILECONNECTIONSTRING app settings, via private endpoints.
The Function App uses the AzureWebJobsStorage and WEBSITE_CONTENTAZUREFILECONNECTIONSTRING app settings to connect to a private endpoint-secured Storage Account.
The Azure Function app provisioned in this sample uses an Azure Functions Elastic Premium plan.
The Storage account that the Function uses for operation and for file contents.
Azure resources in this sample either integrate with or are placed within a virtual network. The use of private endpoints keeps network traffic contained with the virtual network.
The sample uses two subnets:
- Subnet for Azure Function virtual network integration. This subnet is delegated to the Function App.
- Subnet for private endpoints. Private IP addresses are allocated from this subnet.
Azure Private Endpoints are used to connect to specific Azure resources using a private IP address This ensures that network traffic remains within the designated virtual network, and access is available only for specific resources. This sample configures private endpoints for the following Azure resources:
- Azure Storage
- Azure File storage
- Azure Blob storage
- Azure Queue storage
- Azure Table storage
Using a private endpoint to connect to Azure resources means connecting to a private IP address instead of the public endpoint. Existing Azure services are configured to use existing DNS to connect to the public endpoint. The DNS configuration will need to be overridden to connect to the private endpoint.
A private DNS zone will be created for each Azure resource configured with a private endpoint. A DNS A record is created for each private IP address associated with the private endpoint.
The following DNS zones are created in this sample:
- privatelink.queue.core.windows.net
- privatelink.blob.core.windows.net
- privatelink.table.core.windows.net
- privatelink.file.core.windows.net
Application Insights is used to monitor the Azure Function.
After the first time you configure the Function App to talk to the private endpoint-enabled Storage account, you may need to connect to the file system via Kudu (eg by performing a content deployment or by making a GET request to the Kudu /DebugConsole) to refresh the SMB connection so that the Function App can successfully retrieve the contents from the Storage account. The optional deployment script in this template automates these steps.
The script will retrieve the site-level credentials from the publish profile and make an authenticated request to the Kudu /Debugconsole page of the Function App.
To run the deployment script, set the postDeploymentScript parameter to either "azpowershell" or "azclibash" depending upon your deployment environment. If you set the value as "none", the inline deployment script won't get executed.
You will need a user-assigned managed identity to run the script because the script performs ARM actions upon the Function App. The prereqs template creates a user-assigned managed identity.
The managed identity must have resource permissions to download the Function App's publish profile. If the postDeploymentScript parameter in the main template is set to either "azpowershell" or "azclibash", the main template assigns the Contributor role to the managed identity in the scope of the Function App that is deployed. In order to do this, the deployment principal must have Microsoft.Authorization/roleAssignments/write permissions.
Furthermore, the deployment principal must have the permissions described in this document in order to run the deployment script.