0

This is the situation:

  • 1 app service plan with 2 azure functions, function A and function B, both with the same subnet vnet integration enabled
  • 1 subnet with a storage account and private endpoint enabled

In the current situation the network traffic from both function apps can access the private endpoint of the storage account because of the vnet integration.

Is it possible to allow outbound traffic only from function A to the storage account? I don't want to use the service tag in a ngs rule because then both function apps are allowed.

user1809753
  • 165
  • 3
  • 12

1 Answers1

1

This isn't easily attainable with your setup. Both functions share the same pool of IPs from the subnet you're using for vnet injection, so you'll have a difficult time firewalling them from the network perspective.

If you want network isolation, then deploy a separate subnet, and move function B to a new app service plan that has vnet integration enabled on the new subnet. Then you can setup an NSG to block access.

alex
  • 756
  • 4
  • 12