Azure's Function App not being able to access Storage account

I'm working on a Function App (Python code) that should be deployed using a zip file stored in a Storage Account. All the required resources are deployed using Terraform. Everything goes fine during Terraform execution.

I can see all the resources in Azure's Portal. However, the Function App does not run. I can see that that zip file is pushed during Terraform execution. I'm able to download it using the browser, but the Function App can't access the file.

Checking the Function App in the Portal, I can see the message: Azure Functions Runtime is unreachable. It also provides a link for further reading.

With Terraform I created:

1. Function App (it's using an already existing App Service Plan)
2. User Managed Identity (it's used for the Function App to read values from KeyVault and from the Storage Account)
3. Storage Account + Storage Blob

The identity mentioned in step 2 are given roles "Reader" and "Storage Blob Data Contributor". I have tried to set the Function App so that access to Storage Account would happen using the identity or access key. I had the same results.

Any suggestions about this situation? Would I have to create a Private Endpoint for the Storage Account, so that the Function App would access it privately?

EDIT 1:

The problem was solved using a SAS token for retrieving the zip file from the Storage Account. The code is pushed this way:

resource "azurerm_storage_blob" "updater" {
  name                   = "func-name.zip"
  storage_account_name   = azurerm_storage_account.updater.name
  storage_container_name = azurerm_storage_container.updater.name
  type                   = "Block"
  content_md5            = local.updater_md5
  source                 = local.updater_file_path
}

The Function App was set this way:

resource "azurerm_linux_function_app" "updater" {
  name                = "func-app-name"
  // OMITTED CODE
  app_settings = {
    "WEBSITE_RUN_FROM_PACKAGE" = azurerm_storage_blob.updater.url 
    // OMITTED CODE
  }
}

After changing WEBSITE_RUN_FROM_PACKAGE to "https://${azurerm_storage_account.updater.name}.blob.core.windows.net/${azurerm_storage_container.updater.name}/${azurerm_storage_blob.updater.name}${data.azurerm_storage_account_blob_container_sas.updater.sas}", things started working.

Thanks.

When I ran the terraform script with incorrect SAS URL created at container level not blob level where my Function zip exist and also created a zip file on whole Functions folder not Just the trigger, I received the same error code as yours:-

I zipped the entire folder, Refer below:-

And Incorrect SAS url created at container level not blob level where my zip file exist, I received the same error code as yours.

Then, I created zip file only of HttpTrigger1 like below:-

Then I uploaded the above HttpTrigger1 file in my blob storage and created a SAS URL with Read permissions like below:-

Copied the SAS Blob URL and used it in my terraform code like below:-

My main.tf code:-

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.59.0"
    }
  }
}

# Configure the Microsoft Azure Provider
# Configure the Microsoft Azure Provider
provider "azurerm" {
  
subscription_id = "xxxxxxfd-e2b6e97cb2a7"
tenant_id = "xxxxxx99ed-af9038592395"
client_id = "xxxxxd26a31435cb"
client_secret = "xxxxx-CS0ifbLE"
features {
  resource_group {
    prevent_deletion_if_contains_resources = false
  }
}

}



resource "azurerm_resource_group" "example" {
  name     = "azure-functions-example-rgsiddhesh"
  location = "West Europe"
}

resource "azurerm_storage_account" "example" {
  name                     = "examlpesasiliconstrg32"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  depends_on = [ azurerm_resource_group.example ]
}

resource "azurerm_app_service_plan" "example" {
  name                = "azure-functions-example-sp-siliconweb"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  kind                = "Linux"
  reserved            = true
  depends_on = [ azurerm_resource_group.example ]

  sku {
    tier = "Dynamic"
    size = "Y1"
  }

  lifecycle {
    ignore_changes = [
      kind
    ]
  }
}

resource "azurerm_function_app" "example" {
  name                       = "example-azure-function-siliconfunc65"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key
  os_type                    = "linux"
  version                    = "~4"
  depends_on = [ azurerm_storage_account.example ]
  app_settings = {
  WEBSITE_RUN_FROM_PACKAGE = "https://siliconrga233.blob.core.windows.net/func/HttpTrigger1.zip?sp<sastoken>"
      "FUNCTIONS_WORKER_RUNTIME" = "python",
    "AzureWebJobsDisableHomepage" = "true",
    "SCM_DO_BUILD_DURING_DEPLOYMENT" =  "true"
  }
  site_config {
    linux_fx_version = "python|3.10"
  }
}

In my terraform script above, I added these code for the deployment to succeed:-

 app_settings = {
  WEBSITE_RUN_FROM_PACKAGE = "https://siliconrga233.blob.core.windows.net/func/HttpTrigger1.zip?sp=r&st=2023-06-08T17:04:38Z&se=2023-06-09T01:04:38Z&sv=2022-11-02&sr=b&sig=JncUfWoHdCzVPQJifdA56f1B4J%2F6WezSBkGyhRBm25g%3D"
      "FUNCTIONS_WORKER_RUNTIME" = "python",
    "AzureWebJobsDisableHomepage" = "true",
    "SCM_DO_BUILD_DURING_DEPLOYMENT" =  "true"
  }

Make sure your storage account exist in your portal and you create a zip file of your Trigger correctly with SAS URL created at the blob level at the level of zip file of your trigger.

Output:-

Function app with HttpTrigger got deployed successfully, Refer below:-

Reference:-

Publish Azure Functions code with Terraform (maxivanov.io)