如何授权跨租户无公网IP的Azure VM访问带防火墙的存储账户

场景详情 #

• 租户A下的存储账户，网络规则设置为允许从选定的虚拟网络和IP地址访问
• 需要让租户B中无公网IP、未配置NSG的虚拟机，通过服务主体结合azure.storage.blob Python模块下载Blob
• 已尝试将VM的互联网出口公网IP加入存储账户白名单，但请求依然失败

报错信息 #

Traceback (most recent call last):
  File "/tmp/blob_download.py", line 39, in <module>
    download_blob_file(
  File "/tmp/blob_download.py", line 25, in download_blob_file
    blob_contents = blob_client.download_blob().readall()
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/my-envs/py311/lib/python3.11/site-packages/azure/core/tracing/decorator.py", line 76, in wrapper_use_tracer
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/opt/my-envs/py311/lib/python3.11/site-packages/azure/storage/blob/_blob_client.py", line 851, in download_blob
    return StorageStreamDownloader(**options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/my-envs/py311/lib/python3.11/site-packages/azure/storage/blob/_download.py", line 349, in __init__
    self._response = self._initial_request()
                     ^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/my-envs/py311/lib/python3.11/site-packages/azure/storage/blob/_download.py", line 429, in _initial_request
    process_storage_error(error)
  File "/opt/my-envs/py311/lib/python3.11/site-packages/azure/storage/blob/_shared/response_handlers.py", line 181, in process_storage_error
    exec("raise error from None")   # pylint: disable=exec-used # nosec
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<string>", line 1, in <module>
azure.core.exceptions.HttpResponseError: This request is not authorized to perform this operation.
RequestId:xxxxx
Time:2024-10-01T14:12:19.4117902Z
ErrorCode:AuthorizationFailure
Content: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:xxxx
Time:2024-10-01T14:12:19.4117902Z</Message></Error>

已验证的有效条件 #

将存储账户网络规则改为允许从所有网络访问时，下载功能正常，证明以下配置无问题：

• 服务主体已分配Storage Account Key Operator Service Role
• 服务主体已分配存储账户层级的Reader角色
• 服务主体已分配Storage Blob Data Reader角色
• 服务主体已加入存储账户所在租户的Entra ID，租户B的VM通过该服务主体完成认证

内容的提问来源于stack exchange，提问作者Flow