Allow a subnet through a storage firewall

The storage account stdata02 only accepts selected networks, and vm-app's subnet, vnet-app/subnet-app, isn't one of them yet, so vm-app gets 403. Let subnet-app in with a service endpoint and a virtual network rule. The card also compares this with private endpoints, which come up in later levels.

1. Connect to vm-app.

   ssh vm-appType it
   What's this?

   Opens a shell on vm-app, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

2. Try the account. Expect 403. Type exit when done.

   curl -sI https://stdata02.blob.core.windows.netType it
   What's this?

   Fetches a web address and shows the reply. Tells you whether the web service itself answers, not just the port.

   • -s quiet: no progress bar
   • -I ask only for the headers, not the whole page

3. Turn on the service endpoint for subnet-app.

   az network vnet subnet update -g rg-lab --vnet-name vnet-app --name subnet-app --service-endpoints Microsoft.StorageType it
   What's this?

   Changes a subnet's settings, such as which NSG or route table is attached to it.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change

4. Allow subnet-app on the account.

   az storage account network-rule add -g rg-lab --account-name stdata02 --vnet-name vnet-app --subnet subnet-appType it
   What's this?

   Adds a rule to a storage account's firewall: an IP range or a subnet that's allowed in. Network rules only take effect when the default action is Deny.

   • -g the resource group the resources live in
   • --vnet-name the virtual network

5. Look for the new route type in vm-app's routes.

   az network nic show-effective-route-table -g rg-lab --name vm-app-nic -o tableType it
   What's this?

   Lists every route that applies to a VM's network interface: system routes, gateway routes and your route tables, and which are active.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

6. Answer the question below.

   With a service endpoint, does stdata02's name resolve to a private IP? (yes or no)

   Service endpoint

   A subnet setting that sends traffic for an Azure service, like Storage, over Azure's network with the subnet's identity.

   Check