Azure storage firewall support for cloud shell storage accounts (clouddrive)

[vegazbabz]

https://feedback.azure.com/d365community/idea/60c30480-51ae-ed11-a81b-6045bd79fc6e

Cloud shell clouddrive only works with the storage account networking setting set to “Enabled from all networks”. This is pose a potential risk.
When not set to "enabled from all networks", the cloud shell session will be ephemeral.
It is not possible to use the clouddrive nor mount it.

It seems strange that “cloud shell” is depended on full public endpoint instead of having it limited, e.g. via the setting “Allow Azure services on the trusted services list to access this storage account.”
https://learn.microsoft.com/en-us/azure/cloud-shell/overview#connect-your-microsoft-azure-files-storage

Furthermore, there is an unhandled exception, that will make it crash. But since I cannot attach screenshots, it is left with the support.

[theJasonHelmick]

Hi @vegazbabz - thank you for reporting this issue. Cloud Shell also offers an additional secured way of accessing storage accounts for cloud shell using a VNET setup. Have you taken a look at the overview and QuickStart guides for VNET?
https://learn.microsoft.com/en-us/azure/cloud-shell/private-vnet
https://learn.microsoft.com/en-us/azure/cloud-shell/quickstart-deploy-vnet

[vegazbabz]

Hi @theJasonHelmick - we are aware of all the features. The VNet does not solve our issue.
We would need private endpoint support for that. In general, we do not use PaaS services with public endpoint access enabled, such as ACL.
With that said, it still seem strange that cloud shell is not supported if the storage account is running with the ACL/restricted networking settings, but only from All networks.

[dsajanice]

Hi @vegazbabz what you want is achievable by using Cloud Shell's VNet option documented here: https://learn.microsoft.com/en-us/azure/cloud-shell/quickstart-deploy-vnet. Additionally, what you will need to do is create a private link to your storage account (with file access to your fileshare), in the same VNet. Cloud Shell, running in one of the subnets, will be able to access your storage account. This is not documented yet, but if you're willing try it out, please let us know the results.