Skip to content

Commit 1fa8594

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #233854 from jimmart-dev/jammart-storage-global-service-endpoints-ga
storage global service endpoints ga
2 parents 9b1d0c3 + 79cbaea commit 1fa8594

File tree

5 files changed

+40
-191
lines changed

5 files changed

+40
-191
lines changed

‎articles/storage/common/storage-network-security.md

Lines changed: 13 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: storage
55
author: jimmart-dev
66
ms.service: storage
77
ms.topic: how-to
8-
ms.date: 10/04/2022
8+
ms.date: 04/20/2023
99
ms.author: jammart
1010
ms.reviewer: santoshc
1111
ms.subservice: common
@@ -125,7 +125,7 @@ By default, storage accounts accept connections from clients on any network. You
125125
126126
## Grant access from a virtual network
127127
128-
You can configure storage accounts to allow access only from specific subnets. The allowed subnets may belong to a VNet in the same subscription, or those in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant.
128+
You can configure storage accounts to allow access only from specific subnets. The allowed subnets may belong to a VNet in the same subscription or a different subscription, including those belonging to a different Azure Active Directory tenant. With [cross-region service endpoints](#azure-storage-cross-region-service-endpoints), the allowed subnets can also be in different regions from the storage account.
129129
130130
You can enable a [Service endpoint](../../virtual-network/virtual-network-service-endpoints-overview.md) for Azure Storage within the VNet. The service endpoint routes traffic from the VNet through an optimal path to the Azure Storage service. The identities of the subnet and the virtual network are also transmitted with each request. Administrators can then configure network rules for the storage account that allow requests to be received from specific subnets in a VNet. Clients granted access via these network rules must continue to meet the authorization requirements of the storage account to access the data.
131131
@@ -143,101 +143,25 @@ Storage account and the virtual networks granted access may be in different subs
143143
> [!NOTE]
144144
> Configuration of rules that grant access to subnets in virtual networks that are a part of a different Azure Active Directory tenant are currently only supported through PowerShell, CLI and REST APIs. Such rules cannot be configured through the Azure portal, though they may be viewed in the portal.
145145
146-
### Available virtual network regions
146+
### Azure Storage cross-region service endpoints
147147
148-
By default, service endpoints work between virtual networks and service instances in the same Azure region. When using service endpoints with Azure Storage, service endpoints also work between virtual networks and service instances in a [paired region](../../best-practices-availability-paired-regions.md). If you want to use a service endpoint to grant access to virtual networks in other regions, you must register the `AllowGlobalTagsForStorage` feature in the subscription of the virtual network. This capability is currently in public preview.
148+
Cross-region service endpoints for Azure Storage became generally available in April of 2023. They work between virtual networks and storage service instances in any region. With cross-region service endpoints, subnets will no longer use a public IP address to communicate with any storage account, including those in another region. Instead, all the traffic from subnets to storage accounts will use a private IP address as a source IP. As a result, any storage accounts that use IP network rules to permit traffic from those subnets will no longer have an effect.
149149
150-
Service endpoints allow continuity during a regional failover and access to read-only geo-redundant storage (RA-GRS) instances. Network rules that grant access from a virtual network to a storage account also grant access to any RA-GRS instance.
150+
Configuring service endpoints between virtual networks and service instances in a [paired region](../../best-practices-availability-paired-regions.md) can be an important part of your disaster recovery plan. Service endpoints allow continuity during a regional failover and access to read-only geo-redundant storage (RA-GRS) instances. Network rules that grant access from a virtual network to a storage account also grant access to any RA-GRS instance.
151151
152152
When planning for disaster recovery during a regional outage, you should create the VNets in the paired region in advance. Enable service endpoints for Azure Storage, with network rules granting access from these alternative virtual networks. Then apply these rules to your geo-redundant storage accounts.
153153
154-
### Enabling access to virtual networks in other regions (preview)
155-
156-
>
157154
> [!IMPORTANT]
158-
> This capability is currently in PREVIEW.
155+
> Local and cross-region service endpoints cannot coexist on the same subnet.
159156
>
160-
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
161-
162-
To enable access from a virtual network that is located in another region over service endpoints, register the `AllowGlobalTagsForStorage` feature in the subscription of the virtual network. All the subnets in the subscription that has the _AllowedGlobalTagsForStorage_ feature enabled will no longer use a public IP address to communicate with any storage account. Instead, all the traffic from these subnets to storage accounts will use a private IP address as a source IP. As a result, any storage accounts that use IP network rules to permit traffic from those subnets will no longer have an effect.
163-
164-
> [!NOTE]
165-
> For updating the existing service endpoints to access a storage account in another region, perform an [update subnet](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-update&preserve-view=true) operation on the subnet after registering the subscription with the `AllowGlobalTagsForStorage` feature. Similarly, to go back to the old configuration, perform an [update subnet](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-update&preserve-view=true) operation after deregistering the subscription with the `AllowGlobalTagsForStorage` feature.
166-
167-
168-
#### [Portal](#tab/azure-portal)
169-
170-
During the preview you must use either PowerShell or the Azure CLI to enable this feature.
171-
172-
#### [PowerShell](#tab/azure-powershell)
173-
174-
1. Open a Windows PowerShell command window.
175-
176-
1. Sign in to your Azure subscription with the `Connect-AzAccount` command and follow the on-screen directions.
177-
178-
```powershell
179-
Connect-AzAccount
180-
```
181-
182-
2. If your identity is associated with more than one subscription, then set your active subscription to the subscription of the virtual network.
183-
184-
```powershell
185-
$context = Get-AzSubscription -SubscriptionId <subscription-id>
186-
Set-AzContext $context
187-
```
188-
189-
Replace the `<subscription-id>` placeholder value with the ID of your subscription.
190-
191-
3. Register the `AllowGlobalTagsForStorage` feature by using the [Register-AzProviderFeature](/powershell/module/az.resources/register-azproviderfeature) command.
192-
193-
```powershell
194-
Register-AzProviderFeature -ProviderNamespace Microsoft.Network -FeatureName AllowGlobalTagsForStorage
195-
```
196-
197-
> [!NOTE]
198-
> The registration process might not complete immediately. Make sure to verify that the feature is registered before using it.
199-
200-
4. To verify that the registration is complete, use the [Get-AzProviderFeature](/powershell/module/az.resources/get-azproviderfeature) command.
201-
202-
```powershell
203-
Get-AzProviderFeature -ProviderNamespace Microsoft.Network -FeatureName AllowGlobalTagsForStorage
204-
```
205-
206-
#### [Azure CLI](#tab/azure-cli)
207-
208-
1. Open the [Azure Cloud Shell](../../cloud-shell/overview.md), or if you've [installed](/cli/azure/install-azure-cli) the Azure CLI locally, open a command console application such as Windows PowerShell.
209-
210-
2. If your identity is associated with more than one subscription, then set your active subscription to subscription of the virtual network.
211-
212-
```azurecli-interactive
213-
az account set --subscription <subscription-id>
214-
```
215-
216-
Replace the `<subscription-id>` placeholder value with the ID of your subscription.
217-
218-
3. Register the `AllowGlobalTagsForStorage` feature by using the [az feature register](/cli/azure/feature#az-feature-register) command.
219-
220-
```azurecli
221-
az feature register --namespace Microsoft.Network --name AllowGlobalTagsForStorage
222-
```
223-
224-
> [!NOTE]
225-
> The registration process might not complete immediately. Make sure to verify that the feature is registered before using it.
226-
227-
4. To verify that the registration is complete, use the [az feature](/cli/azure/feature#az-feature-show) command.
228-
229-
```azurecli
230-
az feature show --namespace Microsoft.Network --name AllowGlobalTagsForStorage
231-
```
232-
233-
---
157+
> To replace existing service endpoints with cross-region ones, delete the existing **Microsoft.Storage** endpoints and recreate them as cross-region endpoints (**Microsoft.Storage.Global**).
234158
235159
### Managing virtual network rules
236160
237-
You can manage virtual network rules for storage accounts through the Azure portal, PowerShell, or CLIv2.
161+
You can manage virtual network rules for storage accounts through the Azure portal, PowerShell, or CLIv2.
238162
239163
> [!NOTE]
240-
> If you registered the `AllowGlobalTagsForStorage` feature, and you want to enable access to your storage account from a virtual network/subnet in another Azure AD tenant, or in a region other than the region of the storage account or its paired region, then you must use PowerShell or the Azure CLI. The Azure portal does not show subnets in other Azure AD tenants or in regions other than the region of the storage account or its paired region, and hence cannot be used to configure access rules for virtual networks in other regions.
164+
> If you want to enable access to your storage account from a virtual network/subnet in another Azure AD tenant, you must use PowerShell or the Azure CLI. The Azure portal does not show subnets in other Azure AD tenants.
241165
242166
#### [Portal](#tab/azure-portal)
243167
@@ -252,9 +176,7 @@ You can manage virtual network rules for storage accounts through the Azure port
252176
> [!NOTE]
253177
> If a service endpoint for Azure Storage wasn't previously configured for the selected virtual network and subnets, you can configure it as part of this operation.
254178
>
255-
> Presently, only virtual networks belonging to the same Azure Active Directory tenant are shown for selection during rule creation. To grant access to a subnet in a virtual network belonging to another tenant, please use , PowerShell, CLI or REST APIs.
256-
>
257-
> Even if you registered the `AllowGlobalTagsForStorageOnly` feature, subnets in regions other than the region of the storage account or its paired region aren't shown for selection. If you want to enable access to your storage account from a virtual network/subnet in a different region, use the instructions in the PowerShell or Azure CLI tabs.
179+
> Presently, only virtual networks belonging to the same Azure Active Directory tenant are shown for selection during rule creation. To grant access to a subnet in a virtual network belonging to another tenant, please use PowerShell, Azure CLI or REST APIs.
258180
259181
5. To remove a virtual network or subnet rule, select **...** to open the context menu for the virtual network or subnet, and select **Remove**.
260182
@@ -273,7 +195,7 @@ You can manage virtual network rules for storage accounts through the Azure port
273195
3. Enable service endpoint for Azure Storage on an existing virtual network and subnet.
274196
275197
```powershell
276-
Get-AzVirtualNetwork -ResourceGroupName "myresourcegroup" -Name "myvnet" | Set-AzVirtualNetworkSubnetConfig -Name "mysubnet" -AddressPrefix "10.0.0.0/24" -ServiceEndpoint "Microsoft.Storage" | Set-AzVirtualNetwork
198+
Get-AzVirtualNetwork -ResourceGroupName "myresourcegroup" -Name "myvnet" | Set-AzVirtualNetworkSubnetConfig -Name "mysubnet" -AddressPrefix "10.0.0.0/24" -ServiceEndpoint "Microsoft.Storage.Global" | Set-AzVirtualNetwork
277199
```
278200
279201
4. Add a network rule for a virtual network and subnet.
@@ -309,7 +231,7 @@ You can manage virtual network rules for storage accounts through the Azure port
309231
3. Enable service endpoint for Azure Storage on an existing virtual network and subnet.
310232
311233
```azurecli
312-
az network vnet subnet update --resource-group "myresourcegroup" --vnet-name "myvnet" --name "mysubnet" --service-endpoints "Microsoft.Storage"
234+
az network vnet subnet update --resource-group "myresourcegroup" --vnet-name "myvnet" --name "mysubnet" --service-endpoints "Microsoft.Storage.Global"
313235
```
314236
315237
4. Add a network rule for a virtual network and subnet.
@@ -626,7 +548,7 @@ Resources of some services, **when registered in your subscription**, can access
626548
| Azure DevTest Labs | Microsoft.DevTestLab | Custom image creation and artifact installation. [Learn more](../../devtest-labs/devtest-lab-overview.md). |
627549
| Azure Event Grid | Microsoft.EventGrid | Enable Blob Storage event publishing and allow Event Grid to publish to storage queues. Learn about [blob storage events](../../event-grid/overview.md#event-sources) and [publishing to queues](../../event-grid/event-handlers.md). |
628550
| Azure Event Hubs | Microsoft.EventHub | Archive data with Event Hubs Capture. [Learn More](../../event-hubs/event-hubs-capture-overview.md). |
629-
| Azure File Sync | Microsoft.StorageSync | Enables you to transform your on-prem file server to a cache for Azure File shares. Allowing for multi-site sync, fast disaster-recovery, and cloud-side backup. [Learn more](../file-sync/file-sync-planning.md) |
551+
| Azure File Sync | Microsoft.StorageSync | Enables you to transform your on-premises file server to a cache for Azure File shares. Allowing for multi-site sync, fast disaster-recovery, and cloud-side backup. [Learn more](../file-sync/file-sync-planning.md) |
630552
| Azure HDInsight | Microsoft.HDInsight | Provision the initial contents of the default file system for a new HDInsight cluster. [Learn more](../../hdinsight/hdinsight-hadoop-use-blob-storage.md). |
631553
| Azure Import Export | Microsoft.ImportExport | Enables import of data to Azure Storage or export of data from Azure Storage using the Azure Storage Import/Export service. [Learn more](../../import-export/storage-import-export-service.md). |
632554
| Azure Monitor | Microsoft.Insights | Allows writing of monitoring data to a secured storage account, including resource logs, Azure Active Directory sign-in and audit logs, and Microsoft Intune logs. [Learn more](../../azure-monitor/roles-permissions-security.md). |

‎articles/storage/elastic-san/elastic-san-connect-linux.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to connect to an Azure Elastic SAN Preview volume from a
44
author: roygara
55
ms.service: storage
66
ms.topic: how-to
7-
ms.date: 02/22/2023
7+
ms.date: 04/11/2023
88
ms.author: rogarana
99
ms.subservice: elastic-san
1010
ms.custom: references_regions, ignite-2022, devx-track-azurepowershell
@@ -39,7 +39,7 @@ In your virtual network, enable the Storage service endpoint on your subnet. Thi
3939
# [Portal](#tab/azure-portal)
4040

4141
1. Navigate to your virtual network and select **Service Endpoints**.
42-
1. Select **+ Add** and for **Service** select **Microsoft.Storage**.
42+
1. Select **+ Add** and for **Service** select **Microsoft.Storage.Global**.
4343
1. Select any policies you like, and the subnet you deploy your Elastic SAN into and select **Add**.
4444

4545
:::image type="content" source="media/elastic-san-create/elastic-san-service-endpoint.png" alt-text="Screenshot of the virtual network service endpoint page, adding the storage service endpoint." lightbox="media/elastic-san-create/elastic-san-service-endpoint.png":::
@@ -55,21 +55,21 @@ $virtualNetwork = Get-AzVirtualNetwork -ResourceGroupName $resourceGroupName -Na
5555
5656
$subnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $virtualNetwork -Name $subnetName
5757
58-
$virtualNetwork | Set-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix $subnet.AddressPrefix -ServiceEndpoint "Microsoft.Storage" | Set-AzVirtualNetwork
58+
$virtualNetwork | Set-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix $subnet.AddressPrefix -ServiceEndpoint "Microsoft.Storage.Global" | Set-AzVirtualNetwork
5959
```
6060

6161
# [Azure CLI](#tab/azure-cli)
6262

6363
```azurecli
64-
az network vnet subnet update --resource-group "myresourcegroup" --vnet-name "myvnet" --name "mysubnet" --service-endpoints "Microsoft.Storage"
64+
az network vnet subnet update --resource-group "myresourcegroup" --vnet-name "myvnet" --name "mysubnet" --service-endpoints "Microsoft.Storage.Global"
6565
```
6666
---
6767

6868
### Configure volume group networking
6969

7070
Now that you've enabled the service endpoint, configure the network security settings on your volume groups. You can grant network access to a volume group from one or more Azure virtual networks.
7171

72-
By default, no network access is allowed to any volumes in a volume group. Adding a virtual network to your volume group lets you establish iSCSI connections from clients in the same virtual network and subnet to the volumes in the volume group. For details on accessing your volumes from another region, see [Enabling access to virtual networks in other regions (preview)](elastic-san-networking.md#enabling-access-to-virtual-networks-in-other-regions-preview).
72+
By default, no network access is allowed to any volumes in a volume group. Adding a virtual network to your volume group lets you establish iSCSI connections from clients in the same virtual network and subnet to the volumes in the volume group. For details on accessing your volumes from another region, see [Azure Storage global service endpoints](elastic-san-networking.md#azure-storage-global-service-endpoints).
7373

7474
# [Portal](#tab/azure-portal)
7575

0 commit comments

Comments
 (0)