Skip to content

Commit f3f8cec

Browse files
Update copy-blobs-between-storage-accounts-network-restriction.md
Fixed a spelling error with verify and updated some text for workaround 2 while adding links to VNet peering to make it easier to understand.
1 parent d95aed6 commit f3f8cec

1 file changed

Lines changed: 6 additions & 4 deletions

File tree

support/azure/azure-storage/blobs/connectivity/copy-blobs-between-storage-accounts-network-restriction.md

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,20 +67,22 @@ Here's the full process of this mechanism for the two scenarios:
6767
4. The client sends PutBlockList to the destination storage to commit the blocks and finish the process after receiving a success response code from the request.
6868
6969
## Copy blobs between storage accounts in a Hub-spoke architecture using private endpoints
70-
A 403 Error occurs when using AzCopy to copy blobs between Storage accounts connected to private endpoints in different Spoke VNets from a VM in a Hub VNet. You can find a "403 This request is not authorized to perform this operation - CannotVerfiyCopySource" error in the AzCopy logs or in the Azure Storage logs. The following architecture diagram shows the scenario in which the error occurs.
70+
A 403 Error occurs when using AzCopy to copy blobs between Storage accounts connected to private endpoints in different Spoke VNets from a VM in a Hub VNet. You can find a "403 This request is not authorized to perform this operation - CannotVerifyCopySource" error in the AzCopy logs or in the Azure Storage logs. The following architecture diagram shows the scenario in which the error occurs.
7171
7272
:::image type="content" source="media/copy-blobs-between-storage-accounts-network-restriction/hub-spoke-network-topology-architecture.png" alt-text="Diagram that shows the 403 error of copying blobs between storage accounts in a Hub & Spoke architecture using Private Endpoints.":::
7373
7474
### Workaround 1: Create a private endpoint for the destination storage account in the source VNet
75-
A Possible workaround is to create a private endpoint for the destination storage account in the source VNet. This configuration allows the VM to successfully copy the blobs between the storage accounts by using AzCopy. The following architecture diagram shows the process of copying blobs between storage accounts in the Workaround 1.
75+
A possible workaround is to create a private endpoint for the destination storage account in the source VNet. This configuration allows the VM to successfully copy the blobs between the storage accounts by using AzCopy. The following architecture diagram shows the process of copying blobs between storage accounts in Workaround 1.
7676
7777
:::image type="content" source="media/copy-blobs-between-storage-accounts-network-restriction/hub-spoke-network-topology-architecture-mitigation-1.png" alt-text="Diagram that shows the process of copying blobs between storage accounts in Workaround 1.":::
7878
79-
### Workaround 2: Place the VM in the same VNet as the source storage account and peer the VNet with the destination VNet
80-
Another option is to place the VM within the same VNet as the source storage account. Then, establish peering between this VNet and the destination VNet. The following architecture diagram shows the process of copying blobs between storage accounts in Workaround 2.
79+
### Workaround 2: Place the VM in the same VNet as the source storage account and configure VNet peering between the source and destination VNets
80+
Another option is to place the VM within the same VNet as the source storage account while also establishing [virtual network peering](azure/virtual-network/virtual-network-peering-overview) between this VNet and the destination VNet. This peering needs to be directly between the two VNets and cannot be done through the hub VNet. The following architecture diagram shows the process of copying blobs between storage accounts in Workaround 2.
8181
8282
:::image type="content" source="media/copy-blobs-between-storage-accounts-network-restriction/hub-spoke-network-topology-architecture-mitigation-2.png" alt-text="Diagram that shows the process of copying blobs between storage accounts in Workaround 2.":::
8383
84+
More information on virtual network peering can be found here, [Virtual network peering FAQ](azure/virtual-network/virtual-networks-faq#virtual-network-peering).
85+
8486
### Workaround 3: Use a temporary staging account to copy the data
8587
If you're unable to implement the previously mentioned workarounds or are restricted from changing the existing network configuration of the storage account or VNet, you can use a temporary staging account to copy the data:
8688

0 commit comments

Comments
 (0)