Unable to Spin-Up New Service Engine in Azure Due to Policy Restriction

Products

• VMware Avi Load Balancer

Issue/Introduction

• The deployment logs and events indicate an AZURE_ACCESS_FAILURE with a RequestDisallowedByPolicy error message. 
  
  Virtual Service Error (Virtual Service Fault)

  Reason:Azure Error: RequestDisallowedByPolicy Message: Resource 'avisestorage#####' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"##### Storage accounts should restrict network access","id":"/subscriptions/#####/providers/Microsoft.Authorization/policyAssignments/"},"policyDefinition":{"name":"Storage accounts should restrict network access","id":"/providers/Microsoft.Authorization/policyDefinitions/","version":"1.1.1"}},{"policyAssignment":{"name":"<Policy-Name> Policy Initiative","id":"/providers/Microsoft.Management/managementGroups/managed-services/providers/Microsoft.Authorization/policyAssignments/"},"policyDefinition":{"name":"Storage account public access should be disallowed","id":"/providers/Microsoft.Authorization/policyDefinitions/","version":"3.1.1"},"policySetDefinition":{"name":"Alstom CAF Policy Initiative","id":"/providers/Microsoft.Management/managementGroups/managed-services/providers/Microsoft.Authorization/policySetDefinitions/","version":"1.0.0"}}]'. Target: avisestorage#####

• This happens because the Azure Cloud Connector's attempt to create a storage account for SE image management is blocked by one or more Azure policies that restrict public network access.

Environment

• Cloud Platform: Microsoft Azure

Cause

• Error Breakdown
  
  Storage Account Blocked: The resource avisestorage could not be created in Azure by Avi Azure CloudConnector because assigned Azure Policies do not allow it as currently defined.
• The error is caused by a conflict between VMware Avi Load Balancer default behavior for provisioning Service Engine and strict Azure policies in the subscription.
• The policies, such as "Storage accounts should restrict network access" and "Storage account public access should be disallowed," prevent the creation of storage accounts with public access.
• The Avi Cloud Connector, by default, attempts to create a storage account without these specific network access restrictions, which violates the security policies and causes the deployment to fail.

Resolution

• To resolve this issue, the organization must align its Azure environment with VMware Avi Load Balancer operational requirements for Azure Cloud deployment. This requires collaboration with the Azure Support and Customer's Azure Infrastructure Team to either modify the policies or configure the environment to comply with the existing policies.

   

• The recommended solution involves creating a new, compliant storage account and a private endpoint within the same virtual network (VNet) where the Service Engines will be deployed. This approach ensures that the storage account used for SE images adheres to the public access restrictions.

  Steps to Take:

  1. Engage Azure Team: Coordinate with the Azure administrators to understand the specific policies in place and discuss a compliant solution.

  2. Create a New Storage Account: Manually create an Azure Storage Account with public access explicitly disabled and configured to only allow access from specific, pre-approved networks (e.g., the VNet where SEs are deployed).

  3. Create a Private Endpoint: For secure communication, establish a private endpoint for the new storage account within the same VNet. This allows Avi Cloud Connector to securely upload the SE images without violating the public access policy.

Additional Information

• The RequestDisallowedByPolicy error is a security feature of Azure that prevents the creation of resources that do not comply with the organization's governance rules.

• This error is not a bug in the Avi Load Balancer but a result of a policy conflict.

• The solution involves a one-time setup of a compliant storage account that can be used by the Avi Cloud Connector for all future Service Engine deployments.

   

• For detailed instructions on creating storage accounts and private endpoints, refer to the following Microsoft documentation:

  • Create a Private Endpoint for an Azure Storage Account

  • Configure Azure Storage Firewalls and Virtual Networks