How to connect Azure storage account to Logic apps without enabling public access on storage account?

user_13207359 0
Viewed 2437

Does anybody know how to connect to Azure blob storage using Logic App connectors and triggers? I don't want to grant public access on my storage account. It works fine if I allow public access but when I restrict the access to only selected IP's, it stops working and I am unable to connect to the storage account. I have attached the screenshot.

error message

azure-blob-trigger azure-storage-account azure-logic-apps
4 Answers

For this problem, I suggest you to use integrated service environment as Frank mentioned in his answer. But here I provide you with some more detail steps for your reference.

1. Create a virtual network and ensure it has at least 4 subnet, you can just do it by clicking the "Add new virtual network" button in your storage account "Firewalls and virtual networks" tab. enter image description here If you create the virtual network in your storage account "Firewalls and virtual networks", you need to go to the new virtual network and add three subnet to ensure it has at least 4 subnet (shown as below screenshot), and go back to your storage account "Firewall" tab, add the virtual network again (because it may missing after you add three subnets). enter image description here

2. Then, we need to create an integration service environment, choose the virtual network which you created just now at the bottom of the creating page. enter image description here

The creation will take a long time, it took me more than four hours to create the integration service environment.

3. After creating the ISE, we need to create the logic app and choose the ISE which we created when creating the logic app. enter image description here

4. Wait about 20 minutes because the ISE will take some time to be ready even if it was created successfully. And then in your logic app, add the "Azure blob storage" connector with "ISE" icon. enter image description here

5. Add the "create blob" action and it will ask you to create the connection, do creating the connection as before you did and it will generate a API connection in the same resource group of your logic app. enter image description here Wait a few minutes until you can click and open the API connection because this kind of API connection(with ISE) requires more time to be ready. Otherwise you will see some text like "can not find the api azureblob...." in your logic app "create blob" action.

6. Now we can see the items in storage in "create blob" action. enter image description here

user_110992130

First, make sure you have allowed all of the relevant IP addresses. Find all the outbound addresses for your region here.

Second, I would point out that - as you can see on that page - all logic apps, regardless of tenant or subscription, uses the same outbound IP addresses. So while you do create a restriction by whitelisting only those, there is still a security gap that may or may not be acceptable to you.

You can also look into deploying your logic app into an integrated service environment, which integrates with a VNET to which you can also connect your storage account.

user_118703350

It is also possible to connect to storage account from a Standard Logic App using a service endpoint or a private endpoint, which might be a better solution than using ISE, which is very expensive.

This article explains the challenges, and also how to setup the connectivity between a Standard Logic App and a storage account via service endpoint, and via private endpoint.

user_11983790

No need of using ISE for small purpose, you can use Azure Event Grid for Trigger and HTTP to obtain the content of blob.

Please go through this video for more information -

https://www.youtube.com/watch?v=xVFmpszXmC0
user_57777250
Related