Deploying Standard Logic App to Storage Account behind Firewall using Service or Private Endpoints

Standard LogicApp is powered by new Azure single-tenant LogicApp runtime. Single-tenant Logic App offering runs as an extension on top of Azure Function runtime. Like Azure Functions, the standard Logic App leverages storage account services such as blob, File Share, Queue and Table for various purposes. For instance, the website content is stored in File Share which will be accessed by Logic App site for up and running. You can refer to this blog to understand how the storage services are leveraged in standard Logic App.

 

In this article, we will see how to access the Storage account services on secured network using Service endpoints (or) Private Endpoints from Standard Logic App.

 

By default, the portal creation experience of the Logic Apps expects the storage account must be accessible on public endpoint.  Let us explore the below options on how to access the storage account over a secured network.

 

Deploy Logic App standard resource having secured access to Storage account using Portal:

 

• Storage account need to be accessible on Public Endpoint i.e. Network access set to 'All Networks'.
• Create a Logic App resource, selecting the above created storage account during Logic App creation process.
• Enable the Service Endpoint or Private Endpoints (for all services i.e. blob, table, file, queue) on the storage account.
• Enable the VNET integration for Logic App resource with respective VNET and subnet have access to Storage account on Service Endpoint (SE) or Private Endpoints (PE).
• Set the below configuration settings (app settings) to access the storage on SE or PE’s.                     

 

• No need to restart the Logic App site when you update any app settings or adding new workflows, Logic App gracefully restarts in an incremental mode without impacting any existing runs. However, it isn't suggested to make changes when there are any in-process transactions.
• Change the storage account network settings to selected networks 
• Logic App may experience some interruption as the connectivity switch between public and private endpoints may take some time and you may not see workflows for sometime. You may restart the Logic App and wait for few mins and check whether workflows are loading or not.

 

Deploy Logic App standard resource having secured access to Storage account using automated deployment tools:

 

You can overcome the issue of exposing the storage account to public internet with the portal creation experience using ARM template deployment. With ARM deployment, you no need to open it for all Networks and can be deployed directly with Service endpoints or Private Endpoints.

 

 If you would like to deploy Standard Logic App to secure storage account from automated tools such as DevOps using ARM templates.   You can refer to the sample templates available in the below Git-Hub.

VeeraMS/LogicApp-deployment-with-Secure-Storage: Deploying Logic App standard resource with Storage account having Private endpoints (github.com)

 

Note:

When you are using Automated deployment tools, you must make sure FileShare is created in Storage account prior to the LogicApp template deployment and referred the same in Logic App config/app setting (WEBSITE_CONTENTSHARE). 

 

Below GIF's provides a glimpse on how to configure the Logic App to access storage account using Service or Private endpoints.

 

Access over Storage Service Endpoint:

 

 

 Access over Storage Private Endpoints:

 

 

Note: vnetRouteAllEnabled app setting is replaces, overrides and takes precedence over the legacy setting WEBSITE_VNET_ROUTE_ALL.

 

Common Errors when Storage account is behind Firewall:

 

We generally observe the below common errors when deployment storage account is behind firewall which indicates that Logic App is unable to access the storage account services.

 

• Access to host.json is denied:

System.Private.CoreLib: Access to the path 'C:\\home\\site\\wwwroot\\host.json' is denied.

 

• Unable to load workflows in Logic App:

   You may observe that workflows are not visible in the Logic App while Storage access is changed to selected networks or Private Endpoints. You can check the browser logs and it may show below error.

 {"Code":"BadRequest","Message":"Encountered an error (ServiceUnavailable) from host runtime.","Target":null,"Details":       [{"Message":"Encountered an error (ServiceUnavailable) from host runtime."},{"Code":"BadRequest"},{"ErrorEntity":                       {"Code":"BadRequest","Message":"Encountered an error (ServiceUnavailable) from host runtime."}}],"Innererror":null}

 

Troubleshooting common errors:

• Make sure Storage account endpoints are reachable from Logic App VNET over 443 and 445 for respective endpoints. 

Validate the below if you are able to load the Kudu console of the LogicApp:

• Check name resolver command to make sure Storage endpoints are resolved to expected Ip addresses (Private (Private Endpoints)/Public (Service Endpoint or Public endpoint)). To validate this you can run below commands. 

 nameresolver {StorageaccountName}.blob.core.windows.net
 nameresolver {StorageaccountName}.file.core.windows.net

 nameresolver {StorageaccountName}.queue.core.windows.net  

 nameresolver {StorageaccountName}.table.core.windows.net

Note:

Avoid using nslookup in Kudu which by default uses the azure default DNS IP and wont use  Custom DNS server if any if any configured at VNET or Appsetting. 

• Validate the reachability of storage endpoints over 443 and 445 for respective services. 

                        tcpping {StorageaccountName}.blob.core.windows.net:443

                         tcpping {StorageaccountName}.file.core.windows.net:445

                         tcpping {StorageaccountName}.queue.core.windows.net:443

                         tcpping {StorageaccountName}.table.core.windows.net:443

 

If Kudu console itself not loading and have the errors, follow below troubleshooting steps:

We can’t troubleshoot the above common errors from the kudu console when the Logic App site itself isn’t up or working . You can use the below to troubleshoot the access to the storage account services.

 

• Create an Azure VM with in the same Logic App integrated VNET, it can be a different subnet.
• The simpler test can be accessing the Storage account services using the Storage explorer tool. If any issues in connectivity using this tool, continue with the below steps.
• Check nslookup in the command prompt and make sure that the storage services are resolvable to intended IP addresses. If its on Service Endpoint, it should resolve to Public IP and if it has Private Endpoints, verify all services are resolvable to respective NIC private IP addresses. 

            nslookup [StorageaccountHostName] [OptionalDNSServer]

 

          Verify for all storage services:

                           nslookup {StorageaccountName}.blob.core.windows.net

                           nslookup {StorageaccountName}.file.core.windows.net

                           nslookup {StorageaccountName}.queue.core.windows.net

                           nslookup {StorageaccountName}.table.core.windows.net

 

 

• If the DNS queries are resolvable, we can check psping or tcpping to storage account over 443 port.

                 psping [StorageaccountHostName] [Port] [OptionalDNSServer]

 

         Verify for all storage services:

                         psping {StorageaccountName}.blob.core.windows.net:443

                         psping {StorageaccountName}.file.core.windows.net:445

                         psping {StorageaccountName}.queue.core.windows.net:443

                         psping {StorageaccountName}.table.core.windows.net:443

 

• If it is resolvable from Azure VM, we can check the DNS server is used for resolution in VM and set the same in the Logic App WEBSITE_DNS_SERVER setting and verify. Also, make sure that VNET integration is done with the appropriate VNET and subnet in Logic App.

 

References: You may refer to the below blogs for deep dive into Standard Logic App runtime and deployment using DevOps.

Azure Logic Apps Running Anywhere – Runtime Deep Dive (microsoft.com)

Deploying an Azure Logic Apps Standard workflow through Azure DevOps Pipeline - Microsoft Tech Community