Search code examples
azureazure-resource-managerazure-managed-identityazure-bicepazure-logic-app-standard

Api connections(keyvault, servicebus and blob ) using managed identity through bicep

Hi I am trying to create API connections for Key Vault, service bus and storage account using bicep. unfortunately do not see clear documentation from Microsoft side.

created API connections(Azure Key Vault, Service Bus and storage account) using below code, deployment going successfully but connection gets into error state.

    resource ServicebusApiCon 'Microsoft.Web/connections@2016-06-01' = {
    name: 'servicebus'
    location: Location
    kind: 'V2'
    properties: {
      displayName: 'servicebus'     
   
      api: {
       name: 'servicebus'
      description: 'Connect to Azure Serice Bus to send and receive messages'
      id:  '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/
            locations/${Location}/managedApis/servicebus'
      type: 'Microsoft.Web/locations/managedApis'
        }

       }
       }

       resource keyvaultApiCon 'Microsoft.Web/connections@2016-06-01' = {
         name: 'keyvault'
         location: Location
         kind: 'V2'
         properties: {
           displayName: 'keyvault'    

           api:{
            id: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/
                 locations/${Location}/managedApis/keyvault'
            displayName: ' Azure key vault'
            type: 'Microsoft.Web/locations/managedApis'
  
            }

           }
          }
          resource blobApiConnection 'Microsoft.Web/connections@2016-06-01' = {
          name: 'azureblob'
          location: Location
          kind: 'V2'
          properties: {
            displayName: 'azureblob'    
            api: {
              name: 'azureblob'
              displayName: 'Azure Blob storage'
              id: '/subscriptions/${subscription().subscriptionId}/providers
                   /Microsoft.Web/locations/${Location}/managedApis/azureblob'
                 }
                }
               }

could you please suggest me if i am doing something wrong or missing something

Solution

  • To be honest these connection apis are not documented at all... Your best shot is to create them from Azure portal with the networking tab open so you can see what are the requests sent: enter image description here

    enter image description here

    From there I was able to create connection for

    • key vault:

      param logicAppName string

param location string = resourceGroup().location
param keyVaultName string
param name string = 'keyvault'

// Get a reference to the existing logic app
resource logicApp 'Microsoft.Web/sites@2021-03-01' existing = {
  name: logicAppName
}

resource keyvaultConnector 'Microsoft.Web/connections@2018-07-01-preview' = {
  name: name
  location: location
  kind: 'V2'
  properties: {
    displayName: name
    parameterValueType: 'Alternative'
    alternativeParameterValues: {
      vaultName: keyVaultName
    }
    api: {
      id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'keyvault')
      type: 'Microsoft.Web/locations/managedApis'
    }
  }
}

// Grant permission to the logic app standard to access the connection api
resource keyvaultConnectorAccessPolicy 'Microsoft.Web/connections/accessPolicies@2018-07-01-preview' = {
  name: logicAppName
  parent: keyvaultConnector
  location: location
  properties: {
    principal: {
      type: 'ActiveDirectory'
      identity: {
        tenantId: subscription().tenantId
        objectId: logicApp.identity.principalId
      }
    }
  }
}

output connectionRuntimeUrl string = keyvaultConnector.properties.connectionRuntimeUrl

    • service bus:

        param logicAppName string

param location string = resourceGroup().location
param servicebusName string
param name string = 'servicebus'

// Get a reference to the existing logic app
resource logicApp 'Microsoft.Web/sites@2021-03-01' existing = {
  name: logicAppName
}

resource servicebusConnector 'Microsoft.Web/connections@2018-07-01-preview' = {
  name: name
  location: location
  kind: 'V2'
  properties: {
    api: {
      id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'servicebus')
    }
    displayName: name
    parameterValueSet: {
      name: 'managedIdentityAuth'
      values: {
        namespaceEndpoint: {
          value: 'sb://${servicebusName}.servicebus.windows.net/'
        }
      }
    }
  }
}

// Grant permission to the logic app standard to access the connection api
resource servicebusConnectorAccessPolicy 'Microsoft.Web/connections/accessPolicies@2018-07-01-preview' = {
  name: logicAppName
  parent: servicebusConnector
  location: location
  properties: {
    principal: {
      type: 'ActiveDirectory'
      identity: {
        tenantId: subscription().tenantId
        objectId: logicApp.identity.principalId
      }
    }
  }
}

output connectionRuntimeUrl string = servicebusConnector.properties.connectionRuntimeUrl

    You still need to grant permissions to the managed identity to access key vault or servicebus.

    You also will need to update the connectionRuntimeUrl so probably create an app setting for that so it s easier to update: enter image description here