ramesh reddy
ramesh reddy

Reputation: 597

Api connections(keyvault, servicebus and blob ) using managed identity through bicep

Hi I am trying to create API connections for Key Vault, service bus and storage account using bicep. unfortunately do not see clear documentation from Microsoft side.

created API connections(Azure Key Vault, Service Bus and storage account) using below code, deployment going successfully but connection gets into error state.

    resource ServicebusApiCon 'Microsoft.Web/connections@2016-06-01' = {
    name: 'servicebus'
    location: Location
    kind: 'V2'
    properties: {
      displayName: 'servicebus'     
   
      api: {
       name: 'servicebus'
      description: 'Connect to Azure Serice Bus to send and receive messages'
      id:  '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/
            locations/${Location}/managedApis/servicebus'
      type: 'Microsoft.Web/locations/managedApis'
        }

       }
       }

       resource keyvaultApiCon 'Microsoft.Web/connections@2016-06-01' = {
         name: 'keyvault'
         location: Location
         kind: 'V2'
         properties: {
           displayName: 'keyvault'    

           api:{
            id: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/
                 locations/${Location}/managedApis/keyvault'
            displayName: ' Azure key vault'
            type: 'Microsoft.Web/locations/managedApis'
  
            }

           }
          }
          resource blobApiConnection 'Microsoft.Web/connections@2016-06-01' = {
          name: 'azureblob'
          location: Location
          kind: 'V2'
          properties: {
            displayName: 'azureblob'    
            api: {
              name: 'azureblob'
              displayName: 'Azure Blob storage'
              id: '/subscriptions/${subscription().subscriptionId}/providers
                   /Microsoft.Web/locations/${Location}/managedApis/azureblob'
                 }
                }
               }

could you please suggest me if i am doing something wrong or missing something

Upvotes: 2

Views: 3117

Answers (1)

Thomas
Thomas

Reputation: 29736

To be honest these connection apis are not documented at all... Your best shot is to create them from Azure portal with the networking tab open so you can see what are the requests sent: enter image description here

enter image description here

From there I was able to create connection for

  • key vault:

    param logicAppName string
    
    param location string = resourceGroup().location
    param keyVaultName string
    param name string = 'keyvault'
    
    // Get a reference to the existing logic app
    resource logicApp 'Microsoft.Web/sites@2021-03-01' existing = {
      name: logicAppName
    }
    
    resource keyvaultConnector 'Microsoft.Web/connections@2018-07-01-preview' = {
      name: name
      location: location
      kind: 'V2'
      properties: {
        displayName: name
        parameterValueType: 'Alternative'
        alternativeParameterValues: {
          vaultName: keyVaultName
        }
        api: {
          id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'keyvault')
          type: 'Microsoft.Web/locations/managedApis'
        }
      }
    }
    
    // Grant permission to the logic app standard to access the connection api
    resource keyvaultConnectorAccessPolicy 'Microsoft.Web/connections/accessPolicies@2018-07-01-preview' = {
      name: logicAppName
      parent: keyvaultConnector
      location: location
      properties: {
        principal: {
          type: 'ActiveDirectory'
          identity: {
            tenantId: subscription().tenantId
            objectId: logicApp.identity.principalId
          }
        }
      }
    }
    
    output connectionRuntimeUrl string = keyvaultConnector.properties.connectionRuntimeUrl
    
  • service bus:

      param logicAppName string
    
    param location string = resourceGroup().location
    param servicebusName string
    param name string = 'servicebus'
    
    // Get a reference to the existing logic app
    resource logicApp 'Microsoft.Web/sites@2021-03-01' existing = {
      name: logicAppName
    }
    
    resource servicebusConnector 'Microsoft.Web/connections@2018-07-01-preview' = {
      name: name
      location: location
      kind: 'V2'
      properties: {
        api: {
          id: subscriptionResourceId('Microsoft.Web/locations/managedApis', location, 'servicebus')
        }
        displayName: name
        parameterValueSet: {
          name: 'managedIdentityAuth'
          values: {
            namespaceEndpoint: {
              value: 'sb://${servicebusName}.servicebus.windows.net/'
            }
          }
        }
      }
    }
    
    // Grant permission to the logic app standard to access the connection api
    resource servicebusConnectorAccessPolicy 'Microsoft.Web/connections/accessPolicies@2018-07-01-preview' = {
      name: logicAppName
      parent: servicebusConnector
      location: location
      properties: {
        principal: {
          type: 'ActiveDirectory'
          identity: {
            tenantId: subscription().tenantId
            objectId: logicApp.identity.principalId
          }
        }
      }
    }
    
    output connectionRuntimeUrl string = servicebusConnector.properties.connectionRuntimeUrl
    

You still need to grant permissions to the managed identity to access key vault or servicebus.

You also will need to update the connectionRuntimeUrl so probably create an app setting for that so it s easier to update: enter image description here

Upvotes: 3

Related Questions