API Connection Deployment via ARM Template with credentials in Key Vault
Published Apr 13 2022 07:48 PM 5,150 Views
Microsoft

Scenario

Deploy a Logic App’s API Connection (ex: Azure Blob Storage) while storing the credentials in Key Vault.

 

This example uses the Azure Blob Storage connector with the Authentication type as Access Key.

Services Used

Steps

Storing Target Resource’s Credentials in Key Vault

 

Go to the Storage Account > Access keys and select the key which you’ll use to authenticate.

 

KalyaniDhanda_1-1649348536713.png

 

Go to the Key Vault and Create a secret. Store the Storage Account’s Access Key as the secret’s value.

 

KalyaniDhanda_2-1649348536719.png

 

 

Constructing the ARM Template

 

To get a sample template of the connector you want, go to a Logic App, and manually create a connection to that connector first.

 

Note: This example uses Azure Blob Storage connector, with the Authentication type as “Access Key”. You can use a different connector or authentication type.

 

Fill out these details and reate the connection

KalyaniDhanda_3-1649348563475.png

 

Go to the newly created API Connection and select the Export template blade and Download or Copy the template into a text/JSON editor.

 

KalyaniDhanda_4-1649348563488.png

 

In the text editor, remove everything within the resources[] array field. It does not contain the authentication elements we need, which is the Storage Account’s Access Key in this case.

 

KalyaniDhanda_5-1649348563491.png

 

1.      Go to the Edit API connection blade and enter dummy values in or edit any of the fields, so that the Portal will allow you to save it.

 

2.      Go to the Developer Tools of your browser and start capturing a Network trace.

 

3.      Click Save and you’ll see an entry with the API connection name.

 

4.      Go to the Payload tab and scroll down to the Request Payload. Select View Source and copy everything.

KalyaniDhanda_6-1649348563512.png

 

Paste the payload directly into the resource[] array in the text editor.

 

KalyaniDhanda_7-1649348563538.png

 

The Azure Resource Manager (ARM) Tools extension is handy if there are fields missing from the template. In this case, the apiVersion property was missing from the payload/template body, because it's usually sent as a query parameter in the API call.

 

 

KalyaniDhanda_8-1649348563542.png

 

Added the “apiVersion”: “2016-06-01” property to the template body of the API connection resource.

 

KalyaniDhanda_9-1649348563542.png

 

 

1.      Create a new parameter in the parameters object which is going to store the Storage Account’s Access key.

 

2.      Replace the hardcoded accessKey value with a reference to that parameter name.

 

3.      Save this file as a JSON file. Example: Template.json

 

KalyaniDhanda_10-1649348563551.png

 

You can use the Azure Resource Manager (ARM) Tools extension in Visual Studio Code to easily generate the corresponding parameters file, or just create a new file in the same directory as the template file, example: Template.parameters.json

 

We need this parameters file to reference Key Vault.

 

KalyaniDhanda_11-1649348563555.png

 

Instead of storing a value as plaintext, replace the “value” object with a “reference” object. Here, the parameter references the Key Vault by its Resource ID and the Storage Account’s access key by the Key Vault’s Secret Name.

 

KalyaniDhanda_12-1649348563559.png

 

 

Deploying the ARM Template

In the Azure Portal, open the Cloud Shell. Use PowerShell or Azure CLI to deploy the templates.

Upload both Template.json and Template.parameters.json files.

 

KalyaniDhanda_13-1649348584513.png

 

 

Run the following command to deploy them. Replace the ResouceGroupName, and both file names accordingly.

 

New-AzResourceGroupDeployment -ResourceGroupName ResourceGroupName -TemplateFile "Template.json" -TemplateParameterFile "Template.parameters.json"

 

The API connection will be deployed as a new instance or replace the API connection if one already exists with the same name.

 

KalyaniDhanda_14-1649348584516.png

 

 

 

The API connection has successfully deployed with the credentials stored in Key Vault, and ready for use in the Logic App.

References

 

 

1 Comment
Co-Authors
Version history
Last update:
‎Apr 13 2022 07:48 PM
Updated by: