locked
Azcopy fails with 403 forbidden error RRS feed

  • Question

  • Hi

    I'm trying to copy a file from a storage account in UK South to another storage account in the same region

    I installed azcopy in a windows VM which is also based on the UK timezone. 

    I get this error

    ----------------
    Total files transferred: 1
    Transfer successfully:   0
    Transfer skipped:        0
    Transfer failed:         1
    Elapsed time:            00.00:00:00
    [2018/05/22 11:26:40.323+01:00] >>>>>>>>>>>>>>>>
    [2018/05/22 11:26:40.328+01:00][VERBOSE] 7.1.0 : AzCopy /Source:https://my.blob.core.windows.net/backups /Dest:https://my.blob.core.windows.net/backups /SourceKey:****** /DestKey:****** /Pattern:version.txt /v:D:\MyStuff\logs.txt
    [2018/05/22 11:26:40.392+01:00][VERBOSE] Attempt to parse address 'https://my.blob.core.windows.net/backups' to a directory as a candidate location succeeded.
    [2018/05/22 11:26:40.393+01:00][VERBOSE] Source is interpreted as a Cloud blob directory: https://my.blob.core.windows.net/backups.
    [2018/05/22 11:26:40.394+01:00][VERBOSE] Attempt to parse address 'https://my.blob.core.windows.net/backups' to a directory as a candidate location succeeded.
    [2018/05/22 11:26:40.395+01:00][VERBOSE] Destination is interpreted as a Cloud blob directory: https://my.blob.core.windows.net/backups.
    [2018/05/22 11:26:40.824+01:00][VERBOSE] Start transfer: https://my.blob.core.windows.net/backups/version.txt => https://my.blob.core.windows.net/backups/version.txt
    [2018/05/22 11:26:40.965+01:00][VERBOSE] Transfer FAILED: https://my.blob.core.windows.net/backups/version.txt => https://my.blob.core.windows.net/backups/version.txt.
    [2018/05/22 11:26:40.967+01:00][ERROR] https://my.blob.core.windows.net/backups/version.txt: The transfer failed.
    The remote server returned an error: (403) Forbidden.
    This request is not authorized to perform this operation.
    RequestId:2009caa6-d01e-0005-3cb7-f1f7c3000000
    Time:2018-05-22T10:26:40.9299163Z

    What is this time 10:26:40 ? I did the test at 11:26:40

    Tuesday, May 22, 2018 10:35 AM

All replies

  • There has been some discussion on this topic already in the following threads. check and let us know if you need further assistance:

    https://stackoverflow.com/questions/18164350/azcopy-remote-server-returned-403-forbidden

    https://github.com/Azure/azure-storage-net-data-movement/issues/107

    Tuesday, May 22, 2018 5:06 PM
  • It is because of the firewall settings on the storage account, wish the error message is more specific.

    I've enabled the checkbox - Allow trusted Microsoft services to access this storage account. It didn't make any difference! 

    I see a bunch of IP's for UK South DC here - https://www.microsoft.com/en-gb/download/details.aspx?id=41653

    Do you have the list of IP's used by the azure storage account ? So I can open these IP's in the firewall?


    Wednesday, May 23, 2018 8:33 AM
  • Currently you can’t narrow the Azure public IP ranges for storage from the data center IP ranges. But you can nslookup the current IP address related to the storage account and setup the routing. However, the account IP can change as part of the normal storage operations. It does not change often, but it can change any time. So, if and when the IP address changes, the routing will fail, and you will need to update to use the new IP.

    “If this answer was helpful, click “Mark as Answer” or Up-Vote. To provide additional feedback on your forum experience, click here

    • Proposed as answer by vikranth s Wednesday, May 23, 2018 1:57 PM
    Wednesday, May 23, 2018 1:57 PM