Access Storage Accounts behind Firewalls from Logic Apps within the same region

[talsaifi]

Storage accounts behind firewalls will not be accessible by Logic apps within the same region using Azure blob storage connector, because we can not add firewall rules to give access for the connector outgoing IP addresses; please check the following link for details: https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-azureblobstorage#access-stor...

Azure blob storage connector will be returning 403 error, as shown below:

As a workaround, we use the HTTP action to call storage account REST API's using managed identity; to do so, please follow the steps below:

1. Enable your logic app managed identity:
   1. Go to your logic app.
   2. Go to Settings -> Identity.
   3. Select System assigned.
   4. Select Status -> On.
   5. Click Save.                                                                                                                                   
2. In your storage account, add role assignment for your logic app:
   1. Go to your storage account.
   2. Click on access Control (IAM).
   3. Click on Role assignments tab.
   4. Click Add and select Add role assignment:
      1. From the Role dropdown list, select Storage Blob Data Contributor.
      2. From Assign access to dropdown list, select Logic App.
      3. Under the Select field, type the name of your logic app to search for it and select it once it’s found, it will appear under the selected members list.
      4. Click Save.                                                                                                                         
3. In your storage account, make sure that the exception to allow trusted Microsoft services to access this storage account is selected:
   1. Go to your storage account.
   2. Go to Settings -> Networking.
   3. Select Firewalls and virtual networks.
   4. Scroll down to Exceptions.
   5. Select Allow trusted Microsoft services to access this storage account.
   6. Click Save.                                                                                                                               
4. Connect your logic app to storage account using HTTP action to call storage account REST API:
   1. Go to your logic app
   2. Click on View in logic apps designer
   3. Add an action
   4. Search for and select HTTP action:
      1. From method dropdown list, select a method (GET, PUT, etc.).
      2. Enter the URI for the folder under your storage account (https://your account name.blob.core.windows.net/container name/file Name)
      3. Under headers, add the following key value pairs:
         1. Key: x-ms-blob-type, Value: BlockBlob.
         2. Key: x-ms-version, Value: 2019-07-07.
      4. In the body field, enter or select the variable or data token that holds your file content, in case of using PUT method.
      5. From add new parameter, select authentication:
         1. From Authentication type dropdown list, select Managed Identity.
         2. From Managed Identity dropdown list, select System Assigned Managed Identity.
         3. For audience, enter https://storage.azure.com                                                        

[Zoltan]

Great content!

[RienvL]

This was a life safer. Thank you!

[robergc]

Great job!!!

But when I try to connect against table storage I receive a 401 error, even if I pass it the correct authorization header. In Postman it works but not in the logic app.

Do you know how solve it?

[talsaifi]

@robergc This will not work with table storage, logic app and storage account need to be in two different regions to be able to connect to table storage and the reason for this is that table storage does not support Azure AD integration.

Please check the following link for more info: Authorize requests to Azure Storage (REST API) | Microsoft Docs

[AsheN0ne]

@talsaifi Is there any way that a Logic App can connect to table storage with a Storage account behind Firewalls within the same region? If not any alternative ways/methods?

( Tried above and was seeing 403 error ,where I could able to connect through Postman but not through Logic App)

Could you please assist? As we really need Table storage for our logic apps :(

[talsaifi]

@AsheN0ne Actually, at the time when this article was published, the above was not possible with Azure table storage! The good news is that now table storage supports Azure AD Integration  

You can follow the steps above, except:

1- Use Storage Table Data Contributor instead of Storage Blob Data Contributor when adding role assignment.

2- Your HTTP action should look as follows:

1. Enter the URI for the table under your storage account: https://your account name.table.core.windows.net/table name
2. Under Headers, add the following key value pairs:
   1. Key: Accept, Value: application/json.
   2. Key: x-ms-version, Value: 2019-07-07.

For list of REST API operations on table entities, check the following link: Operations on entities (REST API) - Azure Storage | Microsoft Docs

The other option is:

1- Have the storage account and logic app in different regions.

2- Use the Azure Table Storage connector; for connector reference, check the following link: Azure Table Storage - Connectors | Microsoft Docs

3- Add the logic app connector outgoing IP addresses to the storage account firewall to allow access.

[AsheN0ne]

Hi @talsaifi Thank you for the prompt reply!!

So, I have the logic app and the storage account on the same region 
Did followed the steps above:
1- I have assigned Storage Table Data Contributor, Storage Table Data Reader roles and also added outgoing IP addresses to the storage account
2- And I am trying to Insert Entity REST API operation for Table Storage which looks like below

and included the below headers

{
  "Accept": "application/json",
  "Content-Type": "application/json",
  "DataServiceVersion": "3.0;NetFx",
  "MaxDataServiceVersion": "3.0;NetFx",
  "x-ms-date": "Thu, 15 Jul 2021 19:10:40 GMT",
  "x-ms-version": "2019-07-07"
}

and still having 403"AuthorizationFailure" error -- This request is not authorized to perform this operation

I really don't understand what I am doing wrong here :( as I was able to connect to Blob storage but not Table Storage. Could you please tell what am I missing here? @talsaifi  

Thank you in advance!

[talsaifi]

Hi @AsheN0ne

Remove any additional headers, the HTTP action should look as follows:

[AsheN0ne]

@talsaifi Trust me!! I've tried all different ways I could, to get this work :( but nothing helped. Did tried like above

I can give any further details if needed, just can't understand what I am missing here..

Could you please assist!! 

[emanuele86]

Hi @talsaifi 

your solution work but i got some trouble in my scenario.

I have to take attachement from email and copy it to storage account, the problem is that file saved is corrupted if is a xlsx or changed if is a csv(it save the body of previous step in my flow). My flow is configured as follow:

there is a way to take the attachment and save it as-is? (independently by file extension)

[runciblehat]

Thanks for this post which helped me get the result I needed for posting to a queue. For reference in case others need to do this, the syntax is as follows:

Method:      POST

URI:      http://<storage-name>.queue.core.windows.net/<queue-name>/messages

Headers:

Accept	application/json
x-ms-date	utcNow('R')
x-ms-version	2019-07-07

Body

<QueueMessage>
<MessageText>YOUR-MESSAGE</MessageText>
</QueueMessage>

Authentication

Authentication type	Managed Identity
Managed identity	System-assigned managed identity
Audience	https://storage.azure.com

The information which I needed to make this work (esp. getting the format of the x-ms-date field right which is a mandatory field was from the REST API guide here:

https://docs.microsoft.com/en-us/rest/api/storageservices/put-message

[talsaifi]

Hi @emanuele86 

To resolve the issue, please apply the base64toBinary() function on the Attachments Content in the Body field, your HTTP Body code view should look as follows: 

"body": "@base64toBinary(items('For_each')?['ContentBytes'])",

By the way, there is no need for the Get Attachment (V2) action, the Include Attachments option is set to Yes on the trigger and that will retrieve the attachments.

[emanuele86]

Hi @talsaifi ,

great thank you! It works! i also removed get email attachment v2.

"body": "@base64toBinary(items('For_each')?['ContentBytes'])" is good also for csv file?

Other question, there is a way to save only the file in attachment(csv, xlsx...)? Becouse the flow store also image into email signature, for example.

Thanks again

Regards

[talsaifi]

Hi @emanuele86 

"body": "@base64toBinary(items('For_each')?['ContentBytes'])" will work for any file type.

Regarding your other question, you can use the Attachments is Inline property in a Control - Condition action to exclude any inline attachments, your For each loop will look as follows:

[Nikeshvadavathi]

Hi,

Thanks for the article!

I tried the same approach mentioned here, but I am getting the below error even though container named fieldglass exists.

<?xml version="1.0" encoding="utf-8"?><Error><Code>ContainerNotFound</Code><Message>The specified container does not exist.

RequestId:d30706a8-501e-0061-6a3a-9efae8000000

Time:2023-06-13T21:04:10.2196556Z</Message></Error>

[Hasko202]

Is there any way to GET data from blob with this workaround?

[carmelo81]

Any way to get this to work with Azure Files? My flow includes an azure file storage location that is joined to AD.