You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Customer intent: As a developer, I want to understand how to use a secured storage account in a virtual network as the default storage account for my function app, so that my function app can be secure.
9
9
---
10
10
11
11
# How to use a secured storage account with Azure Functions
12
12
13
-
This article shows you how to connect your function appto a secured storage account. For an in-depth tutorial on how to create your function app with inbound and outbound access restrictions, see the [Integrate with a virtual network](functions-create-vnet.md) tutorial. To learn more about Azure Functions and networking, see [Azure Functions networking options](functions-networking-options.md).
13
+
Azure Functions requires an Azure Storage account when you create a function app instance. This default storage account is used by the Functions runtime to maintain the health of your function app. For more information, see [Storage considerations for Azure Functions](storage-considerations.md). This article shows you how to use a secured storage account as the default storage account. For an in-depth tutorial on how to create your function app with inbound and outbound access restrictions, see the [Integrate with a virtual network](functions-create-vnet.md) tutorial. To learn more about Azure Functions and networking, see [Azure Functions networking options](functions-networking-options.md).
14
14
15
15
## Restrict your storage account to a virtual network
16
16
17
-
When you create a function app, you either create a new storage account or link to an existing one. Currently, only the Azure portal, [ARM template deployments](functions-infrastructure-as-code.md?tabs=json&pivots=premium-plan#secured-deployments), and [Bicep deployments](functions-infrastructure-as-code.md?tabs=bicep&pivots=premium-plan#secured-deployments) support function app creation with an existing secured storage account.
17
+
When you create a function app, you either create a new storage account or link to an existing one. Keep these considerations in mind when working with secured storage account.
18
18
19
-
> [!NOTE]
20
-
> Secured storage accounts are supported for all tiers of the [Dedicated (App Service) plan](./dedicated-plan.md) and the [Elastic Premium plan](./functions-premium-plan.md). They're also supported by the [Flex Consumption plan](./flex-consumption-plan.md).
21
-
> The [Consumption plan](consumption-plan.md) doesn't support virtual networks.
22
-
23
-
For a list of all restrictions on storage accounts, see [Storage account requirements](storage-considerations.md#storage-account-requirements).
19
+
+ To create a function app that uses an existing secured storage account as the default storage account, you must create your app either in the [Azure portal](https://portal.azure.com) or by using [ARM template](functions-infrastructure-as-code.md?tabs=json&pivots=premium-plan#secured-deployments) or [Bicep](functions-infrastructure-as-code.md?tabs=bicep&pivots=premium-plan#secured-deployments) deployments.
20
+
+ When using a secured storage account with a dynamic scale plan, you should host your functions in the [Flex Consumption plan](./flex-consumption-plan.md). This plan supports both secured storage accounts and managed identity-based connections to storage, which is the most secure connection option.
21
+
+ All tiers of both the [Dedicated (App Service) plan](./dedicated-plan.md) and the [Elastic Premium plan](./functions-premium-plan.md) also support secure storage accounts. However, there are trade-offs when using managed identities to connect from a Premium plan app. For more information, see [Create an app without Azure Files](storage-considerations.md#create-an-app-without-azure-files).
22
+
+ The [Consumption plan](consumption-plan.md) doesn't support virtual networks, so you can't connect to a secured storage account when running in the Consumption plan. To take advantage of serverless function hosting, you should instead recreate your app to run in Flex Consumption plan.
23
+
+ This article currently shows you how to create a function app in a Premium plan that connects to a secured storage account using the storage account connection string. To provide the best protection of storage account credentials, you should instead use managed identities when connecting to a storage account. Instead follow the [Quickstart: Create and deploy functions to Azure Functions using the Azure Developer CLI](create-first-function-azure-developer-cli.md) to create a function app in the Flex Consumption plan that connects to a new secured storage account using managed identities.
24
+
+ For a list of all restrictions on storage accounts, see [Storage account requirements](storage-considerations.md#storage-account-requirements).
24
25
25
26
## Secure storage during function app creation
26
27
@@ -59,7 +60,7 @@ Set up a secured storage account for your function app:
59
60
60
61
1.[Create a second storage account](../storage/common/storage-account-create.md). This storage account is the secured storage account for your function app to use instead of its original unsecured storage account. You can also use an existing storage account not already being used by Functions.
61
62
62
-
1. Save the connection string for this storage account to use later.
63
+
1. Save the connection string for this storage account to use later.
63
64
64
65
1.[Create a file share](../storage/files/storage-how-to-create-file-share.md#create-a-file-share) in the new storage account. For your convenience, you can use the same file share name from your original storage account. Otherwise, if you use a new file share name, you must update your app setting.
Copy file name to clipboardExpand all lines: articles/azure-functions/container-concepts.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ There are several options for hosting your containerized function apps in Azure:
24
24
| Hosting option | Benefits |
25
25
| --- | --- |
26
26
|**[Azure Container Apps]**| Azure Functions provides integrated support for developing, deploying, and managing containerized function apps on [Azure Container Apps](../container-apps/overview.md). This enables you to manage your apps using the same Functions tools and pages in the Azure portal. Use Azure Container Apps to host your function app containers when you need to run your event-driven functions in Azure in the same environment as other microservices, APIs, websites, workflows, or any container hosted programs. Container Apps hosting lets you run your functions in a managed Kubernetes-based environment with built-in support for open-source monitoring, mTLS, Dapr, and KEDA. Supports scale-to-zero and provides a serverless pay-for-what-you-use hosting model. You can also request dedicated hardware, even GPUs, by using workload profiles. _Recommended hosting option for running containerized function apps on Azure._|
27
-
|**Azure Arc-enabled Kubernetes clusters (preview)**| You can host your function apps on Azure Arc-enabled Kubernetes clusters as either a [code-only deployment](./create-first-function-arc-cli.md) or in a [custom Linux container](./create-first-function-arc-custom-container.md). Azure Arc lets you attach Kubernetes clusters so that you can manage and configure them in Azure. _Hosting Azure Functions containers on Azure Arc-enabled Kubernetes clusters is currently in preview._|
27
+
|**Azure Arc-enabled Kubernetes clusters (preview)**| You can host your function apps on Azure Arc-enabled Kubernetes clusters as either a code-only deployment or in a custom Linux container. Azure Arc lets you attach Kubernetes clusters so that you can manage and configure them in Azure. _Hosting Azure Functions containers on Azure Arc-enabled Kubernetes clusters is currently in preview._ For more information, see [Working with containers and Azure Functions](functions-how-to-custom-container.md?pivots=azure-arc).|
28
28
|**[Azure Functions]**| You can host your containerized function apps in Azure Functions by running the container in either an [Elastic Premium plan](./functions-premium-plan.md) or a [Dedicated plan](./dedicated-plan.md). Premium plan hosting provides you with the benefits of dynamic scaling. You might want to use Dedicated plan hosting to take advantage of existing unused App Service plan resources. |
29
29
|**[Kubernetes]**| Because the Azure Functions runtime provides flexibility in hosting where and how you want, you can host and manage your function app containers directly in Kubernetes clusters. [KEDA](https://keda.sh) (Kubernetes-based Event Driven Autoscaling) pairs seamlessly with the Azure Functions runtime and tooling to provide event driven scale in Kubernetes. Just keep in mind that running your containerized function apps on Kubernetes, either by using KEDA or by direct deployment, is an open-source effort that you can use free of cost, with best-effort support provided by contributors and from the community. You're responsible for maintaining your own function app containers in a cluster, even when deploying to Azure Kubernetes Service (AKS). |
30
30
@@ -77,7 +77,6 @@ The degree to which various features and behaviors of Azure Functions are suppor
77
77
| Create my first containerized functions |[Create a function app in a local Linux container](functions-create-container-registry.md)|
78
78
| Create and deploy functions to Azure Container Apps |[Create your first containerized functions on Azure Container Apps](functions-deploy-container-apps.md)|
79
79
| Create and deploy containerized functions to Azure Functions |[Create your first containerized Azure Functions](functions-deploy-container.md)|
80
-
| Create and deploy functions to Azure Arc-enabled Kubernetes |[Create your first containerized Azure Functions on Azure Arc (preview)](create-first-function-arc-custom-container.md)|
0 commit comments