Hello, does anyone know if this is working? I have a logic app with Vnet integration (outbound). I created a key vault with a private endpoint (no service endpoint for this resource type) and Im trying to list secrets/keys from keyvault. I have activated firewall on key vault. Somehow access is being blocked. Which IPs do I need to whitelist? I did a whitelist on the private endpoint subnet of created key vault or do I need to whitelist outbound IP addresses? I did the same for storage account, there it works flawless...
#Azure logic app access to key vault via private endpoint
late dome
wraith lion
You could also try to whitelist the service tag LogicApps
A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.
late dome
no NSG or UDR is in use. When I checked logs I saw its being routed over public IP address but I would have expect outbound traffic to flow through Vnet
burnt hearth
Logic Apps and Function Apps working on Private Endpoints are notoriously annoying. You're not using a consumption based hosting plan are you? That's the first thing I'd check. The consumption plans aren't eligible for use of Private Endpoints. Since you're already interacting with the VNet Integration you likely already know this but worth double checking.
Additionally, check your app settings for the Function. There should be something listed called "WEBSITE_CONTENTOVERVNET" and the value should be 1. Try that and see if that unblocks you.
After that, seeing what DNS settings your app settings are using would be my next suggestion. Look for "WEBSITE_DNS_SERVER" and if that's not listed, create it and point to your DNS server. If you're having Azure handle DNS, then use 168.63.129.16
Hope this helps!
late dome
Hi @burnt hearth thanks for your response logic app is standard plan type, I was able to resolve it. As you have said WEBSITE_CONTENTOVERVNET is set to 1 and WEBSITE_DNS_SERVE is configured to private dns. The issue was the connector which has been used in workflow. There are two connectors for "Azure Key Vault", one "Key Vault in App" and "Azure Key Vault". "Azure Key Vault" connector uses public routes which is not documented......so if someone faces the same problem go ahead and use "Key Vault in App" connector, after that traffic will be routed over private network and is working as designed
burnt hearth
Ah yes, managed connectors are the only ones that work over private endpoints you are correct