blocks|key|757058|text|当前的networkRuleSet配置已经足够了。我无法使用与您相同的networkRuleSet配置来重现此问题。因此，在创建容器或查询networkRuleSet时，您可以反复检查是否存在存储帐户的错误。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|757059|默认情况下，存储帐户接受来自任何网络上客户端的连接。若要限制对选定网络的访问，必须首先更改默认操作。|757060|如果您只需要允许从某些特定IP地址或特定子网访问存储帐户并允许Azure服务，您可以这样添加它，|757061|{
++"bypass":+"AzureServices",
++"defaultAction":+"Deny",
++"ipRules":+[
++++{
++++++"action":+"Allow",
++++++"ipAddressOrRange":+"100.100.100.100"
++++}
++],
++"virtualNetworkRules":+[
++++{
++++++"action":+"Allow",
++++++"virtualNetworkResourceId":+"subnetID"
++++}
++]
}|code-block|syntax|javascript|757062|使用Azure+CLI，将默认规则设置为默认允许网络访问。|757063|az+storage+account+update+--resource-group+"myresourcegroup"+--name+"mystorageaccount"+--default-action+Deny

az+storage+account+update+--resource-group+"myresourcegroup"+--name+"mystorageaccount"+--default-action+Allow|757064|有关更多详细信息，请参阅更改默认网络访问规则。|757065|编辑|757066|在本例中，您将--auth-mode参数设置为登录到使用Azure+AD凭据进行授权。您需要确保登录到Azure+CLI的Azure+AD安全主体拥有对Blob或队列存储执行数据操作的权限。有关Azure存储中RBAC角色的详细信息，请参阅使用RBAC管理Azure存储数据的访问权限。|757067|entityMap|0|LINK|mutability|MUTABLE|url|https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security#change-the-default-network-access-rule|1|https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-operations-cli?toc=/azure/storage/blobs/toc.json#authorize-with-azure-ad-credentials|2|https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal#assign-rbac-roles-using-the-azure-portal^0|3|E|Z|E|1X|E|0|0|0|0|0|0|C|A|0|0|0|7|B|Q|G|1|3C|M|2|0^^$0|@$1|2|3|4|5|6|7|1A|8|@$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]|$9|1F|A|1G|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1H|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|1I|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|1J|8|@]|D|@]|E|$M|N]]|$1|O|3|P|5|6|7|1K|8|@]|D|@]|E|$]]|$1|Q|3|R|5|L|7|1L|8|@]|D|@]|E|$M|N]]|$1|S|3|T|5|6|7|1M|8|@]|D|@$9|1N|A|1O|1|1P]]|E|$]]|$1|U|3|V|5|6|7|1Q|8|@]|D|@]|E|$]]|$1|W|3|X|5|6|7|1R|8|@$9|1S|A|1T|B|C]]|D|@$9|1U|A|1V|1|1W]|$9|1X|A|1Y|1|1Z]]|E|$]]|$1|Y|3|-4|5|6|7|20|8|@]|D|@]|E|$]]]|Z|$10|$5|11|12|13|E|$14|15]]|16|$5|11|12|13|E|$14|17]]|18|$5|11|12|13|E|$14|19]]]]

The current <code>networkRuleSet</code> configuration is enough. I can not reproduce this issue with the same <code>networkRuleSet</code> configuration as you. So you may double-check if there is a typo for the storage account when creating a container or querying the <code>networkRuleSet</code>.

By default, storage accounts accept connections from clients on any network. To limit access to selected networks, you must first change the default action.

If you need to only allow access your storage account from some specific IP addresses or specific subnets and allow Azure services, you can add it like this,

<pre><code>{
 "bypass": "AzureServices",
 "defaultAction": "Deny",
 "ipRules": [
 {
 "action": "Allow",
 "ipAddressOrRange": "100.100.100.100"
 }
 ],
 "virtualNetworkRules": [
 {
 "action": "Allow",
 "virtualNetworkResourceId": "subnetID"
 }
 ]
}
</code></pre>

With Azure CLI, Set the default rule to allow network access by default.

<pre><code>az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Deny

az storage account update --resource-group "myresourcegroup" --name "mystorageaccount" --default-action Allow
</code></pre>

See <a href="https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security#change-the-default-network-access-rule" rel="nofollow noreferrer">Change the default network access rule</a> for more details.

<h2>Edit</h2>

In this case, you set the <code>--auth-mode</code> parameter to login to <a href="https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-operations-cli?toc=/azure/storage/blobs/toc.json#authorize-with-azure-ad-credentials" rel="nofollow noreferrer">authorize with Azure AD credentials</a>. You need to ensure that the Azure AD security principal with which you sign in to Azure CLI has permission to do data operations against Blob or Queue storage. For more information about RBAC roles in Azure Storage, see <a href="https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-portal#assign-rbac-roles-using-the-azure-portal" rel="nofollow noreferrer">Manage access rights to Azure Storage data with RBAC</a>.

blocks|key|125114|text|不确定这是否有帮助..。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|125115|如果您更新了存储帐户的“防火墙和虚拟网络”部分，并使用CLI对所有网络进行访问，则需要一些时间才能生效。我观察到它大约需要10-30秒才能生效。|125116|尝试等待30秒，然后尝试az容器create语句。应该管用的。|125117|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Not sure if this would be helpful ...
If you update the &quot;Firewalls and virtual networks&quot; section of the Storage account and make it accessible for all networks , using CLI , it takes sometime to take effect. I have observed that it takes around 10 -30 seconds to take effect.
Try waiting for 30 seconds and then try the az container create statement. It should work.

blocks|key|968750|text|虽然所选的答案不同。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|968751|还有另一个原因，就像我的情况一样。如Microsoft文档这里所述，在创建容器之前，您需要担任此角色。|offset|length|968752|在创建容器之前，将Storage数据贡献者角色分配给自己。即使您是帐户所有者，也需要显式权限才能对存储帐户执行数据操作。|blockquote|968753|还请注意|968754|Azure角色分配可能需要几分钟来传播。|968755|entityMap|0|LINK|mutability|MUTABLE|url|https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli#example-authorize-an-operation-to-create-a-container-with-azure-ad-credentials^0|0|T|2|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@$D|W|E|X|1|Y]]|A|$]]|$1|F|3|G|5|H|7|Z|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|10|8|@]|9|@]|A|$]]|$1|K|3|L|5|H|7|11|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

Although the selected answer is different.
There can be another reason as in my case. You need to be in the role before you can create a container as stated by Microsoft documentation <a href="https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli#example-authorize-an-operation-to-create-a-container-with-azure-ad-credentials" rel="nofollow noreferrer">here</a>
<blockquote>
Before you create the container, assign the Storage Blob Data
Contributor role to yourself. Even though you are the account owner,
you need explicit permissions to perform data operations against the
storage account.
</blockquote>
Also note that
<blockquote>
Azure role assignments may take a few minutes to propagate.
</blockquote>

blocks|key|125164|text|从命令中删除--auth-mode+login。像这样使用它：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|125165|az+storage+container+create+\
--account-name+helloworld12345+\
--name+images+\
--public-access+container|code-block|syntax|javascript|125166|如果我们不设置--auth-mode，它将使用默认的auth模式key。，它将查询存储帐户中的帐户密钥。|125167|https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli|125168|如果命令中需要RBAC角色，则使用--auth-mode+login。有关存储中RBAC角色的更多信息，请访问https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli。|125169|entityMap|0|LINK|mutability|MUTABLE|url|1|https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli^0|6|H|0|0|7|B|W|3|0|0|2B|0|0|H|H|1J|28|1|0^^$0|@$1|2|3|4|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|13|8|@$9|14|A|15|B|C]|$9|16|A|17|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|18|8|@]|D|@$9|19|A|1A|1|1B]]|E|$]]|$1|O|3|P|5|6|7|1C|8|@$9|1D|A|1E|B|C]]|D|@$9|1F|A|1G|1|1H]]|E|$]]|$1|Q|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]]|R|$S|$5|T|U|V|E|$W|N]]|X|$5|T|U|V|E|$W|Y]]]]

Remove the <code>--auth-mode login</code> from your command. Use it like this:
<pre class="lang-sh prettyprint-override"><code>az storage container create \
--account-name helloworld12345 \
--name images \
--public-access container
</code></pre>
If we don't set <code>--auth-mode</code>, it uses the default auth-mode <code>key</code>. Which will query for the account key inside your storage account
<a href="https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli</a>
<hr />
Use <code>--auth-mode login</code> if you have required RBAC roles in your command. For more information about RBAC roles in storage, visit <a href="https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli</a>.

Following the instructions for <a href="https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-cli" rel="nofollow noreferrer">the Azure CLI "quickstart" on creating a blob</a>. 

It looks like something in the default storage account is blocking the ability to create new containers; yet, the <code>"defaultAction"</code> is <code>Allow</code>:

The following Azure CLI:

<pre><code>az storage container create --account-name meaningfulname --name nancy --auth-mode login
</code></pre>

... results in the error explaining the network rules of the Storage Account might be the cause:

<pre><code>The request may be blocked by network rules of storage account. Please check network rule set using 'az storage account show -n accountname --query networkRuleSet'.
If you want to change the default action to apply when no rule matches, please use 'az storage account update'.
</code></pre>

Using the suggestion from the above message, the "show" command on the account-name gives:

<pre><code>&gt; az storage account show -n meaningfulname --query networkRuleSet
{
 "bypass": "AzureServices",
 "defaultAction": "Allow",
 "ipRules": [],
 "virtualNetworkRules": []
}
</code></pre>

I would think that the Azure CLI would be among the "services" that could bypass and do operations. And, the default action would seem to me to be quite permissive. 

I've done to searching around by the error messages and commands (and variations). There does not appear to be much on what I don't know the quirks of the Azure CLI, so maybe this is so obvious that people haven't written anything up. I don't think I'm duplicating

Network Rules of storage account blocking container creation

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

按照的说明执行。看起来，默认存储帐户中的某些内容阻碍了创建新容器的能力；然而，"defaultAction"是Allow。以下Azure CLI：az storage container create --account-name meaningfulname --name nancy --auth-mode logi...

问存储帐户阻塞容器创建的网络规则
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问存储帐户阻塞容器创建的网络规则EN