Unable to create VNET flow logs, deployment fails with status "Bad Gateway"

Hi Saraswat, Aarushi,

Thanks for your question on the Microsoft Q&A portal!

You're trying to create VNET flow logs that send logs to a storage account in a different subscription (SIEM subscription). However, your deployment fails at the last stage with status "Bad Gateway" and an Authorization Failed error. The error message means:

• The user or service principal you're using does not have the required permissions to read the storage account where the logs should be stored.
• This permission is essential because Azure Network Watcher needs to access the storage account to write the flow logs.
• If you recently granted permissions, you might need to refresh authentication tokens or retry after some time.

Here are the few steps to fix the issue:

1.Grant Storage Account Permissions

• Go to the Azure portal, navigate to the Storage Account in the SIEM subscription.
• Select Access control (IAM) > Role assignments.
• Add a role assignment for the Network Watcher service principal or the user/service principal doing the deployment.

2.Assign the correct role:

• Assign the Storage Blob Data Contributor role or higher to allow reading and writing blobs.
• Optionally, assign Storage Account Contributor if broader management rights are necessary.

3.Confirm the scope:

• Make sure you assign the role at the storage account scope, not just at subscription or resource group level.

4.Refresh credentials if needed:

• If roles were assigned recently, sign out and back into the Azure portal or refresh your authentication tools (CLI/PowerShell). This ensures tokens are updated.

5.Verify network setup:

• Ensure the Storage Account allows access from the Network Watcher's virtual network or set networking to Allow trusted Microsoft services if private endpoints or firewall rules are used.

6.Retry creating flow logs:

• Once permissions are set, retry the flow log deployment.

Here are the few additional things to check:

• Storage account must be in the same Azure region as the virtual network for flow logs.
• There must be an active Network Watcher instance in the region.
• Flow logs require a properly configured Network Watcher role assignment.

 Useful documents:

• Manage virtual network flow logs:https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage?tabs=portal
• Role-based access control (RBAC) for Storage Accounts:https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory
• Network Watcher RBAC permissions:https://learn.microsoft.com/en-us/azure/network-watcher/required-rbac-permissions
• https://learn.microsoft.com/en-us/azure/role-based-access-control/

The root cause is missing or insufficient storage account permissions for the Network Watcher to write flow logs. Assign Storage Blob Data Contributor role at the storage account level to the Network Watcher service principal or your deployment user. Refresh your credentials and retry the deployment.

If you follow these steps, your VNET flow logs deployment should succeed.

I hope this helps you resolve the issue. If you have any further quires, I am happy to assist

Thank you.

Pranitha