Mount Azure File Share on Azure Container with access key retrieval in ARM Template

Question

I'm creating a file share and container instance using ARM template, and I need to mount this created file share to the container. I have the below template -

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountType": {
      "type": "string",
      "defaultValue": "Standard_GRS",
      "metadata": {
        "description": "Storage Account type"
      }
    },
    "storageAccountName": {
      "type": "string",
      "defaultValue": "[concat('storage', uniquestring(resourceGroup().id))]",
      "metadata": {
        "description": "Name of the Azure Storage account."
      }
    },
    "sharePrefix": {
      "type": "string",
      "defaultValue": "files",
      "metadata": {
        "description": "Specifies the prefix of the file share names."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    .....
  },
  "variables": {
    "ContainerGroupName": "[concat('my-cg',uniquestring(resourceGroup().id))]",
    "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
    "ContainerName": "my-container"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[parameters('storageAccountName')]",
      "apiVersion": "2019-06-01",
      "location": "[parameters('location')]",
      "kind": "Storage",
      "sku": {
        "name": "[parameters('storageAccountType')]"
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
      "apiVersion": "2019-06-01",
      "name": "[concat(parameters('storageAccountName'), '/default/', parameters('sharePrefix'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    },
    {
      "name": "[variables('ContainerGroupName')]",
      "type": "Microsoft.ContainerInstance/containerGroups",
      "apiVersion": "2018-10-01",
      "location": "[parameters('location')]",
      "properties": {
        "containers": [
          {
            "name": "[variables('ContainerName')]",
            "properties": {
              "image": "imageNameinACR",
              "resources": {
                "requests": {
                  "memoryInGB": 14,
                  "cpu": 4
                }
              },
              "volumeMounts": [
                {
                  "name": "filesharevolume",
                  "mountPath": "/app"
                }
              ]
            }
          }
        ],
        "imageRegistryCredentials": [
          ....
        ],
        "restartPolicy": "OnFailure",
        "osType": "Linux",
        "volumes": [
          {
            "name": "filesharevolume",
            "azureFile": {
              "shareName": "[concat(parameters('storageAccountName'), '/default/', parameters('sharePrefix'))]",
              "storageAccountName": "[parameters('storageAccountName')]",
              "storageAccountKey": "[listKeys(parameters('storageAccountName'), '2019-06-01').keys[0].value]"
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), 'default', parameters('sharePrefix'))]"
      ]
    }
  ],
  "outputs": {}
}

However, this is throwing the error

"error": { "code": "CannotAccessStorageAccount", "message": "The Azure storage account 'storage6x2un3wwsta6u' in volume 'filesharevolume' can't be accessed: 'The remote server returned an error: (400) Bad Request.'. This can be caused by incorrect Azure storage account key or Azure storage firewalls." }

I've also tried the resourceId to retrieve the secret like below, but it throws the same error.

"storageAccountKey": "[listKeys(variables('storageAccountId'), '2019-06-01').keys[0].value]"

Am I missing anything in the template? I referred to various samples that show this method to retrieve access keys in ARM template.

In my DOCKERFILE for the container image, I'm running RUN MKDIR /App

Could there be an issue with the mount path? My assumption is that the fileshare will be mounted in this directory - /app/filesharevolume.

Charles Xu · Accepted Answer · 2021-06-28T01:09:44.077

1

I don't see the definition of the variable storageAccountId, but the template function listkeys really works with the resource Id. So I give the code that works on my side:

"storageAccountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value]"

And if the storage account is not in the same resource group with the container group, then you can add the group name of the storage account when you get the resource Id:

"storageAccountKey": "[listKeys(resourceId(variables('resourceGroupName'), 'Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value]

Here is the example.

Update:

And there is a problem in the volumes of the container group. You need to change the file share name into this:

"volumes": [
          {
            "name": "filesharevolume",
            "azureFile": {
              "shareName": "[parameters('sharePrefix')]",
              "storageAccountName": "[parameters('storageAccountName')]",
              "storageAccountKey": "[listKeys(parameters('storageAccountName'), '2019-06-01').keys[0].value]"
            }
          }
        ]

edited Jun 28 '21 at 01:09

answered Jun 25 '21 at 01:20

Charles Xu

29,862
2
22
39

Thanks Charles. I've defined the storageAccountId the same way in variables above, and I have the storageAccountName in parameters - "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", Both the container group and storage account are created in this arm template, and they will be in the same resource group. But even using the resourceId like you suggested above was throwing the same 400 error for me when I tried using the variable storageAccountId. – Kruti Joshi Jun 25 '21 at 05:45
1

@KrutiJoshi Maybe you can try to change the `shareName` in the `volumes` with the value `parameters('sharePrefix')`. – Charles Xu Jun 25 '21 at 09:47
Thanks Charles. I believe that was the issue. I now have the below and it's working perfectly. Can you update your answer for me to accept it? "azureFile": { "shareName": "[parameters('sharePrefix')]", "storageAccountName": "[variables('storageAccountName')]", "storageAccountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2019-06-01').keys[0].value]" } – Kruti Joshi Jun 25 '21 at 10:32
@KrutiJoshi Sure. Did it. – Charles Xu Jun 28 '21 at 01:10

Mount Azure File Share on Azure Container with access key retrieval in ARM Template

1 Answers1