You are deploying a new Azure virtual machine named VM1 to a subnet named Subnet1 in a virtual network named VNet1. You plan to use the Custom Script Extension to run a post-deployment configuration script on VM1 during provisioning.
The script is stored in a private container in an Azure storage account named storage1. The firewall of storage1 is configured to restrict access to 'Selected networks'.
You need to ensure that VM1 can download and execute the script during the provisioning phase.
What should you configure?
- Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.Cevap
- BEnable the 'Allow trusted Microsoft services to access this storage account' setting in the firewall configuration of storage1.
- CAssign a system-assigned managed identity to VM1, and grant the identity the Storage Blob Data Reader role on storage1.
- DConfigure a private DNS zone for storage1 and link it to VNet1 without creating a private endpoint.
Cevap
Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.
The correct configuration is to enable the Microsoft.Storage service endpoint on the subnet where the VM resides and add a corresponding virtual network rule on the storage account. Because the Custom Script Extension runs inside the guest operating system of the virtual machine, the download request is initiated directly from the VM's network interface using its subnet configuration. Enabling the service endpoint and allowing the subnet through the storage firewall grants the VM secure access to retrieve the script.
Adım Adım Çözüm
Anahtar Kavram
Configuring network access to Azure Storage for Virtual Machine extensions during deployment
Tahmini Süre:1m 30s