# Unable to use repository-azure plugin to connect to Azure storage account in Gov cloud **URL:** \ **Category:** Elasticsearch\ **Created:** [May 14, 2025, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147 "2025-05-14T17:03:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![dfinn](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Post date:** [May 14, 2025, 5:03pm UTC](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147/1 "2025-05-14T17:03:37Z")
We successfully use the repository-azure plugin to use azure blob storage as a snapshot repo and have been doing this for quite a while in multiple elasticsearch clusters on Azure AKS in their commercial cloud. We have 2 elasticsearch clusters in Azure Gov and we recently noticed that neither is able to make use of the azure blob storage when configured as a snapshot repo. We are getting the following error: ```auto { "name": "ResponseError", "message": "repository_verification_exception\n\tCaused by:\n\t\tblob_storage_exception: blob_storage_exception: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.\nIf you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.\nPlease remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.\nStatus code 403, \"AuthorizationFailureThis request is not authorized to perform this operation.\nRequestId:93eaa554-101e-0015-0ff0-b95d77000000\nTime:2025-04-30T16:55:49.0032266Z\"\n\tRoot causes:\n\t\tblob_storage_exception: blob_storage_exception: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.\nIf you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.\nPlease remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.\nStatus code 403, \"AuthorizationFailureThis request is not authorized to perform this operation.\nRequestId:93eaa554-101e-0015-0ff0-b95d77000000\nTime:2025-04-30T16:55:49.0032266Z\"" } ``` We have made sure to set `azure.client.default.endpoint_suffix: "core.usgovcloudapi.net"` on the gov instances. We are configuring elasticsearch to use the account and key for this storage account. I have confirmed that I can manually access this storage account using the key with curl but for whatever reason elasticsearch is not able to do this successfully. I suspect it has something to do with the repository-azure plugin and Gov but I don't yet have any way of proving this other than it doesn't work via elasticsearch but works fine for me manually. This is on 8.15.3 running on k8s. I have filed a bug but it was quickly closed unfortunately: > > > \### Elasticsearch Version > > 8.15.3 > > \### Installed Plugins > > repository-azure > > \### …Java Version > > \_bundled\_ > > \### OS Version > > Docker > > \### Problem Description > > We are running a self managed ES cluster on k8s. We use this same setup in both Azure and Azure gov. In normal Azure this works fine however we noticed recently that on our Elasticsearch clusters in gov we are not able to register a snapshot repository using Azure. We get the following error when attempting to do that: > > \`\`\` > { > "name": "ResponseError", > "message": "repository\_verification\_exception\\n\\tCaused by:\\n\\t\\tblob\_storage\_exception: blob\_storage\_exception: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.\\nIf you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.\\nPlease remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.\\nStatus code 403, \\"\\\AuthorizationFailure\\This request is not authorized to perform this operation.\\nRequestId:93eaa554-101e-0015-0ff0-b95d77000000\\nTime:2025-04-30T16:55:49.0032266Z\\\\"\\n\\tRoot causes:\\n\\t\\tblob\_storage\_exception: blob\_storage\_exception: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.\\nIf you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.\\nPlease remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.\\nStatus code 403, \\"\\\AuthorizationFailure\\This request is not authorized to perform this operation.\\nRequestId:93eaa554-101e-0015-0ff0-b95d77000000\\nTime:2025-04-30T16:55:49.0032266Z\\\\"" > } > \`\`\` > > we suspect that something with the SDK is not setting something correctly for gov. > > \### Steps to Reproduce > > register snapshot repo using Azure storage in Gov cloud > > \### Logs (if relevant) > > see error above any help would be much appreciated ---
**Author:** ![Roberto\_Seldner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roberto_seldner/32/85416_2.png) [@Roberto\_Seldner](https://discuss.elastic.co/u/Roberto_Seldner)\ **Post date:** [May 30, 2025, 5:04pm UTC](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147/2 "2025-05-30T17:04:53Z")
I can't comment on Azure Gov regions, but I've encountered this exact error on an Azure commercial region due to the Firewall config on the blob storage side. ---
**Author:** ![dfinn](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Post date:** [June 2, 2025, 6:31pm UTC](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147/3 "2025-06-02T18:31:52Z")
I was hopeful but unfortunately it doesn't look like it's that simple. I set the firewall to "Enable from all networks" and it doesn't seem to making a difference, elaticsearch still can't communicate with the azure blob storage.