Azure IoT FOTA cannot download update images

I have a test application which uses the "Azure IoT Hub" library. I have set up the IoT Hub, Update Account, update instance, etc. The device does successfully connect to the IoT Hub and sends test MQTT data to the hub. My problem is that the over-the-air updates (FOTA) are not working.

Specifically, the Device Twin info about the update does in fact get to my device and my device does try to download the update binary. It's obvious that my device does not have the credential (SAS?) to download the binary from the Azure storage container.

I do not have the container setup for public access. My assumption is that it should not be public, but the access to the files uses a SAS which is provided by the update.

Here is a snippet of the log (with some specifics x'd out):

00> [00:00:22.744,262] <dbg> azure_iot_hub: device_twin_result_process: Request ID: 221
00> [00:00:22.745,513] <inf> azure_iot_hub_sample: Azure FOTA state report is created and ready to be sent
00> [00:00:22.745,574] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"current","currentFwVersion":"0.0.1"}}
00> [00:00:22.746,978] <inf> azure_fota: Attempting to download firmware (version '0.0.2') from xxxxxxxxxxxxxxxx.blob.core.windows.net/xxxxxxxxxxxxxxxxxx/xxxxxxxxxxx-update_0.1_generated.importmanifest.json
00> [00:00:22.747,100] <inf> download_client: Downloading: xxxxxxxxxxxxcontainer1/xxxxxxxxxxxx-update_0.1_generated.importmanifest.json [0]
00> [00:00:22.747,253] <inf> azure_iot_hub_sample: Azure FOTA download has started
00> [00:00:22.747,314] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"downloading","currentFwVersion":"0.0.1","pendingFwVersion":"0.0.2","jobId":"xxxxxxxxxxx-4171-4209-a49d-700c35567d1d"}}
00> [00:00:22.747,344] <dbg> azure_iot_hub: device_twin_result_process: FOTA message handled
00> [00:00:22.747,375] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_TWIN_RECEIVED
00> [00:00:23.402,954] <inf> download_client: Setting up TLS credentials, sec tag count 1
00> [00:00:23.403,137] <inf> download_client: Connecting to xxxx.xxxx.xxxx.xxxx
00> [00:00:28.398,742] <err> download_client: Unexpected HTTP response: 409 public access is not permitted on this storage account.
00> [00:00:28.398,773] <err> fota_download: Download client error
00> [00:00:28.400,390] <err> azure_fota: FOTA download failed
00> [00:00:28.400,512] <inf> azure_iot_hub_sample: Azure FOTA error

Questions:

1. Am I supposed to expose the update file(s) to the public? How are they protected such that only my device(s) can download them?
2. Which update file(s) should be used? The zip (which contains the binary) or the manifest json (which would presumably instruct the code as to how to install the update)?
3. Once the update file (zip? Bin? Json?) file is downloaded, does the FOTA library know how to apply it, i.e. reflash itself?
Thank you!
Related