Logic Apps Preview enables hosting Logic apps runtime on top of App Service infrastructure and as a result inherits many platform capabilities that App Service offers. In this blog we are going to explore some of the network capabilities that you can leverage to secure your workflows running in Logic Apps preview.
Networking overview of Logic Apps preview
The azure storage that is configured in the default create experience will have a public endpoint that the Logic Apps runtime will use for storing state of your workflows.
The managed API service (azure connectors) is a separate service hosted in azure and is shared by multiple customers. The Logic Apps runtime uses a public endpoint for accessing the API connector service.
Securing Inbound Traffic Using Private Endpoints
See here for instructions for adding a private endpoint to your Logic App preview. When you add a private endpoint:
An alternative configuration
Securing Outbound Traffic Using vNET integration
To secure your outbound traffic from your web app, enable VNet Integration. By default, your app outbound traffic will only be affected by NSGs and UDRs if you are going to a private address (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Securing Storage Account by using storage private endpoints.
Azure storage allows you to enable private endpoints on storage account and lock it down to be accessed only within your own vNET. We can leverage this capability by enabling private endpoint on the storage account used by your Logic Apps.
If your workflow app is not coming up, you can use the Kudu console of the app to check the name resolution and the connectivity. Pls note that you need to connect to kudu console from the vnet if you have enabled private endpoints on the app. Here are some good pointers on debugging connectivity issues.
For example, we can test the private queue endpoint dns resolution for “workflowState” as shown below.
And the connectivity to the private endpoint can be tested as shown below:
This article provides an in-depth detail on different networking options available on App Service platform and Logic Apps preview inherits most of these features given it is running on the App service infrastructure.
Here is a set of ARM templates and workflows of a sample of Logic App integrated into a vNET.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.