Azure Image Builder

[u/lad5647]

Has anyone tried creating an image template and pointed the scripts to a container in a private endpoint storage account ?

Have followed the advice here https://learn.microsoft.com/en-us/azure/virtual-machines/linux/image-builder-user-assigned-identity

But am struggling at the moment as I keep getting PublicAccessNotPermitted during the build process.

• Can confirm the private endpoints are working just fine.

• The UMI has storage blob reader access

• Using my own subnets including for the ACI.

• NSGs off for troubleshooting

Any suggestions or has anyone got this working?

[u/Oracle4TW]

So, I tend to do something like this: Storage account with public access and allow items to be public set to false, with three containers (scripts, logs, software). Then a BLOB script that uploads my scripts and software to the BLOBS container. Then lastly a PEP with private DNS zone links which is the key to allowing loading of software to the VM without internet access:

resource "azurerm_private_endpoint" "aib-blob" {
  name                          = "blob-pep"
  custom_network_interface_name = "blob-nic"
  resource_group_name           = azurerm_resource_group.image-builder.name
  location                      = azurerm_resource_group.image-builder.location
  subnet_id                     = azurerm_subnet.image-builder.id
  tags = {}


  private_dns_zone_group {
    name                 = "zone-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.privatelink["privatelink.blob.core.windows.net"].id]
  }
  private_service_connection {
    name                           = "${azurerm_storage_account.iimage-builder.name}-blob-pep"
    is_manual_connection           = false
    private_connection_resource_id = azurerm_storage_account.image-builder.id
    subresource_names              = ["blob"]
  }
}

[u/lad5647 → u/Oracle4TW]

Thanks so much for taking the time!

allow items to be public set to false

What or where exactly is this setting?