Enable MSI and retrieve object id in azurerm_logic_app_workflow

[gburton1]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

We'd like the ability to enable MSI from an azurerm_logic_app_workflow, and then capture that object id into an output that can be used in other resources.

New or Affected Resource(s)

azurerm_logic_app_workflow

Potential Terraform Configuration

References

https://docs.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity

[rohrerb]

@tombuildsstuff or @JunyiYi do you know if this is possible today or is this a net new feature?

[dhabierre]

I need this feature too!

Using Terraform I create an azurerm_logic_app_workflow resource. The LogicApp needs to access a KeyVault secret.

But at present time it is not possible to enable MSI (it is possible with azurerm_app_service resources) and then retrieve the object_id in order to create an access_policy.

Thanks!

[dhabierre]

My current solution.

Terraform

locals {
  "domain" = "${var.environment}-${var.application}"
}

resource "azurerm_logic_app_workflow" "logic_app_workflow_get_secret" {
  name                = "${local.domain}-logic-app-get-secret"
  location            = "${azurerm_resource_group.resource_group.location}"
  resource_group_name = "${azurerm_resource_group.resource_group.name}"
  tags                = "${local.tags}"

  lifecycle {
    ignore_changes = ["parameters", "tags"] # prevent that Terraform fails while updating the container once the LogicApp ARM has been deployed the first time
  }
}

LogicApp that required MSI to access to KeyVault secrets

Just add identity.type = "SystemAssigned"

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": { ... },
  "resources": [
    {
      "apiVersion": "2017-07-01",
      "location": "[parameters('location')]",
      "name": "[parameters('workflowName')]",
      "properties": {
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
          "actions": { ... },
          "parameters": { ... },
          "triggers": { ... },
          "contentVersion": "1.0.0.0",
          "outputs": {}
        },
        "parameters": { ... },
        "identity": {
          "type": "SystemAssigned"
        },
      "tags": { ... },
      "type": "Microsoft.Logic/workflows"
    }
  ],
  "outputs": {}
}

Note: this LogicApp is deployed using an Azure Resource Group Deployment task.

Azure DevOps / Release

Add an Azure CLI task in order to create the Access Policy:

call az resource show --resource-group $(environment)-$(application) --name $(environment)-$(application)-logic-app-get-secret --resource-type Microsoft.Logic/workflows --api-version 2016-06-01 --query "identity.principalId" > tmpData

set /p data= < tmpData

call az keyvault set-policy --name "$(environment)-$(application)-keyvault" --object-id %data% --key-permissions get list --secret-permissions get list

Tips : to retrieve the LogicApp Url trigger (Azure PowerShell task):

$workflowName = "$(environment)-$(application)-logic-app-get-secret"

$data = Get-AzureRmLogicAppTriggerCallbackUrl -ResourceGroupName "$(environment)-$(application)" -Name $workflowName -TriggerName "manual"

$endpoint = $data.Value

Write-Host "##vso[task.setvariable variable=LogicAppGetSecretEndpoint]$endpoint"

[willjblair]

Just add identity.type = "SystemAssigned"

@dhabierre Does this setup work when deploying for you? In Microsoft documentation the identity is included at the top level of the ARM resource definition, not in the properties object.

I agree that this process would be much simpler in terraforms though

[rom1gal]

Hey there,

Any updates on that issue ?

Thanks !

[rom1gal]

Hi !

Still UPping the topic just in case :)

[fewbits]

I also needed this feature and end up finding this issue.

I need to create Logic Apps to startup and shutdown some VMs based on a certain recurrence. I was wondering wether to use Logic Apps, Function Apps or Automation Account, but I found that using Logic Apps was the simplest solution. The problem is that I need to use a system assigned or used assigned managed identity onto these Logic Apps to give them permission to control the VMs.

[shybbko]

I also needed this feature and end up finding this issue.

I need to create Logic Apps to startup and shutdown some VMs based on a certain recurrence. I was wondering wether to use Logic Apps, Function Apps or Automation Account, but I found that using Logic Apps was the simplest solution. The problem is that I need to use a system assigned or used assigned managed identity onto these Logic Apps to give them permission to control the VMs.

I might be wrong (and I don't have an active Azure subscription to test / confirm), but I believe that you have an option to configure identity in Logic Apps manually via portal, then download the whole config as an ARM and deploy it that way via Terraform. Something along these lines.

[BartoszDopke]

Are any updates with it?

[geekzter]

With Logic Apps now supporting MSI for (more) connectors, this is becoming a more relevant capability to have.