Request originated from VNET through service endpoint. This is blocked by your Cosmos DB account firewall settings

Question

I am working on a closing all of my resources in a private network in Azure, for the time being I have select 3 resources. 1. Function App 2. Azure Cosmos DB 3. Azure Storage Account

I have created an function app with following network settings

I have selected inbound access as open for now. And in outbound access, I have enabled VNET integration with a subnet named app-subnet.

I have created a cosmos DB account for MongoDB API with private end point enabled in same VNET but in different subnet named az-subnet.

Same process I have done for storage account.(using az-subnet)

Now I am able to access storage account from function app, but not cosmos DB.

Error on saving document is

Request originated from VNET through service endpoint. This is blocked by your Cosmos DB account firewall settings

Please help, like exactly what I am missing here.

Answer 1

You need to Configure the service endpoint for the Azure virtual network and subnet. You can do it in Cosmos DB settings' Firewall and virtual networks option.

Follow below steps:

1. Select Firewalls and virtual networks from the settings menu, and choose to allow access from Selected networks.

2. To grant access to an existing virtual network's subnet, under Virtual networks, select Add existing Azure virtual network.

3. Select the Subscription from which you want to add an Azure virtual network. Select the Azure Virtual networks and Subnets that you want to provide access to your Azure Cosmos DB account. Next, select Enable to enable selected networks with service endpoints for "Microsoft.AzureCosmosDB". When it's complete, select Add. Refer below image.

4. After the Azure Cosmos DB account is enabled for access from a virtual network, it will allow traffic from only this chosen subnet. The virtual network and subnet that you added should appear as shown in the following screenshot:

Note: Configuring a VNET service endpoint may take up to 15 minutes to propagate and the endpoint may exhibit an inconsistent behavior during this period.

Source: Configure access to Azure Cosmos DB from virtual networks (VNet)