How to Automatically Import Keyvault References in Your Logic App Env Variables After a Terraform Deploy

Welcome to this tutorial, where we’ll show you how to automatically import Keyvault references in your Logic App environment variables after a Terraform deploy. This process may seem daunting, but trust us, it’s easier than you think! So, buckle up and let’s get started!

What You’ll Need

Before we dive into the tutorial, make sure you have the following:

• A working Azure subscription
• Terraform installed on your machine
• A Keyvault setup with secrets and variables
• A Logic App created in Azure
• A basic understanding of Terraform and Azure services (don’t worry, we’ll explain the rest)

Step 1: Configure Your Terraform File

Open your Terraform file (e.g., `main.tf`) and add the following code to create a Keyvault:

provider "azurerm" {
  version = "2.34.0"
  subscription_id = "your_subscription_id"
  client_id      = "your_client_id"
  client_secret = "your_client_secret"
  tenant_id      = "your_tenant_id"
}

resource "azurerm_key_vault" "example" {
  name                = "example-keyvault"
  resource_group_name = "example-resource-group"
  location           = "West US"
  sku_name          = "standard"
}

resource "azurerm_key_vault_secret" "example" {
  name      = "example-secret"
  value     = "example-value"
  vault_uri = azurerm_key_vault.example.vault_uri
}

Replace the placeholders with your actual Azure subscription and Keyvault details. This code creates a new Keyvault and a secret named `example-secret` with the value `example-value`.

Step 2: Create a Logic App

Head over to the Azure portal and create a new Logic App. Give it a name, select a resource group, and choose a location. We’ll use this Logic App to consume the Keyvault secrets later.

Step 3: Configure Logic App Environment Variables

In the Logic App, navigate to the “Environment variables” section. Click “New variable” and add the following:

Variable name	Value
KEYVAULT_NAME	example-keyvault
SECRET_NAME	example-secret

We’ll use these environment variables to connect to our Keyvault and retrieve the secret value.

Step 4: Create an Azure Function to Fetch Keyvault Secrets

Create a new Azure Function (e.g., `GetKeyvaultSecret`) with the following code:

using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.Logging;
using System.Threading.Tasks;
using Microsoft.Azure.KeyVault;
using Microsoft.Azure.KeyVault.Models;

public static void Run(
    [TimerTrigger("0 */5 * * * *")] TimerInfo myTimer,
    ILogger logger)
{
    logger.LogInformation($"GetKeyvaultSecret function executed at {DateTime.Now}");

    // Get Keyvault name and secret name from environment variables
    string keyvaultName = Environment.GetEnvironmentVariable("KEYVAULT_NAME");
    string secretName = Environment.GetEnvironmentVariable("SECRET_NAME");

    // Create a new Keyvault client
    var client = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(
        async (authority, resource, scope) => {
            var token = await GetAccessToken(authority, resource, scope);
            return new TokenCredential(token);
        }));

    // Get the secret value
    var secret = client.GetSecretAsync($"https://{keyvaultName}.vault.azure.net", secretName).Result;
    string secretValue = secret.Value;

    // Log the secret value
    logger.LogInformation($"Secret value: {secretValue}");
}

// Helper function to get an access token
static async Task GetAccessToken(string authority, string resource, string scope)
{
    // Implement your authentication logic here
    // For example, using Azure identity
    var credential = new DefaultAzureCredential();
    var token = credential.GetToken(new TokenRequestContext(new[] { $"https://{resource}/.default" }));
    return token.Token;
}

This Azure Function fetches the secret value from the Keyvault using the `GetSecretAsync` method. Make sure to update the `GetAccessToken` function to use your preferred authentication method.

Step 5: Deploy Terraform and Azure Function

Run the following Terraform command to deploy your infrastructure:

terraform init
terraform apply

This will create the Keyvault, secret, and Logic App environment variables.

Next, deploy your Azure Function using your preferred method (e.g., Visual Studio, Azure Functions Core Tools, or Azure DevOps).

Step 6: Configure Logic App to Consume Azure Function

In the Logic App, add a new action and search for “Azure Functions”. Select the “Azure Functions” action and choose the `GetKeyvaultSecret` function we created earlier.

In the “Request” section, add a new parameter:

{
  "name": "secretValue",
  "type": "string",
  "value": "@body('Get_keyvault_secret')?.secretValue"
}

This will pass the secret value from the Azure Function to the Logic App.

Step 7: Automate Keyvault Reference Import

Create a new Logic App action and search for “Set variable”. Add a new variable:

{
  "name": "KEYVAULT_REFERENCE",
  "type": "string",
  "value": "@concat('https://', variables('KEYVAULT_NAME'), '.vault.azure.net/secrets/', variables('SECRET_NAME'), '/?version=')",
  "description": "Keyvault reference URL"
}

This sets a new environment variable `KEYVAULT_REFERENCE` with the Keyvault reference URL.

Step 8: Verify Keyvault Reference Import

Run the Logic App to test the `GetKeyvaultSecret` function and verify that the `KEYVAULT_REFERENCE` environment variable is set correctly.

That’s it! You’ve successfully automated the import of Keyvault references in your Logic App environment variables after a Terraform deploy.

Conclusion

In this tutorial, we demonstrated how to automatically import Keyvault references in your Logic App environment variables after a Terraform deploy. By following these steps, you can securely store and retrieve secrets in your Azure environment.

Remember to update the Azure Function’s authentication logic to use your preferred method. Additionally, ensure proper error handling and logging in your Logic App and Azure Function.

Happy coding, and don’t hesitate to reach out if you have any questions or face any issues!

Keywords: Azure, Terraform, Keyvault, Logic App, Environment Variables, Automation, Security, Secrets Management

Feel free to bookmark this article and share it with your friends and colleagues!

Frequently Asked Question

Get ready to unlock the secrets of importing Keyvault references in your Logic app env variables with ease!