Question 304735 in Azure Question posted in
The official documentation to get you started can be found here.

Logic App with Managed Identity that gets triggered when a new Azure KeyVault Secret is to Expire

I have managed to create a Logic App that can send an email once an Azure KeyVault secret is about to expire. This works with my own credentials, but I cannot make it work with Managed Identity api connection.

For my Logic App I have enabled System Identity. Chosen "When an Event Grid resource event occurs" as the trigger and added RBAC role "Key Vault Administrator" to my Azure KeyVault

enter image description here

This now allows me to choose my KeyVault in the drop down menus on the trigger, which means my Managed Identity does have a connection to the KeyVault and I can pick up values in the drop down lists:

enter image description here

When I try to save this I get the following error:

Failed to save logic app logic-secrets-expiry-poc-mi. The workflow connection parameter ‘azureeventgrid’ is not valid. The API connection ‘azureeventgrid’ is configured to support managed identity but the connection parameter is either missing ‘authentication’ property in connection properties or authentication type is not ‘ManagedServiceIdentity’.

What am I missing here?

Update: I found a workaround. I the Code view in the UI, I added this to the connection part:

"connectionProperties": {
        "authentication": {
             "type": "ManagedServiceIdentity"
                   }
         }

so that it looks now like this:

enter image description here

This allows me to Save the Logic App in the Portal without getting the error.

Update: However I cannot get it to trigger even when I add another Event to listen to like "Microsoft.KeyVault.SecretNewVersionCreated" and try to create new Secrets in KeyVault. It is not being triggered.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Here is how to use Managed Identity from A-Z:

    Start by creating a Key Vault and a Logic App (Consumption type used in this demo) enter image description here

    Enable Managed Identity on your Logic App: enter image description here

    Use RBAC permission model: enter image description here

    Add 2 RBAC roles to your KeyVault:

    • Key Vault Crypto Service Encryption User
    • Key Vault Secrets Office enter image description here

    Verify that the RBAC roles have been added: enter image description here enter image description here

    Add a trigger for your Logic App using Managed Identity: enter image description here

    and choose these events: enter image description here

    Verify that the Trigger History has no errors: enter image description here

    Check that that the Event Grid Subscription has been created: enter image description here

    Create a new Secret: enter image description here

    Check that your Logic App has been triggered now: enter image description here

    And in the final step you can see details in the run: enter image description here

    Done


  2. 0

    It is not being triggered.

    I have got triggered and below is my approach:

    Firstly gave this role to managed identity of my logic app:

    enter image description here

    Then gave Key Vault Secrets Officer :

    enter image description here

    Need to have RBAC for Key Vault:

    enter image description here

    Then have used below design:

    /subscriptions/<subscriptionid>/resourceGroups/<resourcegroupname>/providers/Microsoft.KeyVault/vaults/<keyvaultname>

    enter image description here

    Output:

    When version changed it got triggered.

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search