Creating a Logic App to remind Key Vault key Expiry

Pallab Chakraborty 401

We are using CMK for our Storage Accounts. We would like to set up some kind of a reminder so that email is sent out 30 days before the key expiry to designated email accounts. I was told that there is an Event Grid connector which i can use to achieve this along with Logic Apps.
So i am trying to design the Logic Apps, but i am not able to login to my Outlook account to configure the email from where i can send the reminder email.
Can anyone let me know why the login to Outlook is not working even after putting the right email address and password.

I have attached the screenshot of the error message

1 answer

MayankBargali-MSFT 69,581 Reputation points

2021-05-18T05:02:45.253+00:00

@Anonymous I will suggest you to verify if there is any adblock or extension on your browser that is blocking the request. If there is any then please try disabling it and retry the operation.

I will also suggest you to try a different browser and incognito window to see if it helps you. If you are using the Safari browser then the suggestion would be testing with other browsers or disabling the "Prevent cross-site scripting" setting in their Safari browser.
Please sign in to rate this answer.
Pallab Chakraborty 401 Reputation points

2021-05-18T11:37:45.577+00:00

Actually the issue was i was using Office365 Outlook along with my personal outlook.com email address. The option i should have chosen was Outlook.com. So it worked now. I have another question. I have configured the Logic App now along with Event Grid Trigger for the key expiry. But i am not receiving the alert. As you can see above in the screenshot , the Trigger is "Microsoft.KeyVault.KeyNearExpiry".
So to simulate this, i created a key yesterday inside my Azure KV with expiry date just one month after so that i can receive the alert. But i haven't got any mail in my Gmail still .
I have given RBAC role "Key Vault Reader" to my Logic App "Secret Reminder" to the Key Vault. Is this the correct RBAC role that i need to specify on the Key Vault? Also, anything that i am missing here. Appreciate any help

MayankBargali-MSFT 69,581 Reputation points

2021-05-21T09:32:00.84+00:00

@Anonymous Thanks for the update. Can you please confirm whether the logic app was triggered or not? I think you are only using the response from the "When a resource event occurs" trigger. The logic app should have trigger 30 days before the expiration date for the event Microsoft.KeyVault.KeyNearExpiry. As per the key vault document I don't see any permission that you need to explicitly specify. I have tested the setup at my end and observed that the logicapp gets triggered. The suggestion would be to first verify whether the logic app was triggered or not. If yes, then check the history of that execution whether it was failed or not. If failed then at which action.

Pallab Chakraborty 401 Reputation points

2021-05-21T16:08:55.717+00:00

@MayankBargali-MSFT Hi mayank, i want the Logic App to remind me of my Storage Account Customer Managed Key. So it is a key and not a secret. So shouldn't i be using in the Event Type " Microsoft.KeyVault.KeyNearExpiry" ? This is a CMK and not a secret. I created another CMK yesterday with 30 days expiry, but i don't see any email.
I only get the email when i go to Overview and Trigger the Logic App manually. Automatic mail i didn't get even though i created a new key exactly with 30 days expiry.
So now i have created a secret also with 30 day expiry and added that as a second event as you mentioned.

I will see if i get the email or not for Secret. Any troubleshooting that i can do, or refer to any logs?
I don't see any history in the "Runs History" apart from my manually runned ones.

MayankBargali-MSFT 69,581 Reputation points

2021-05-21T16:40:22.68+00:00

@Anonymous My bad. I have updated the screenshot with the right event. Can you please create a key with less than 29 days just to make sure that once you create the key after a few minutes the events get fired for the testing purpose. As you don't see anything in the run history then we might need to verify whether the KeyValut resource provider has pushed the event to event grid topic or not. If the test didn't help then please share the screenshot of the key expiration date.

Pallab Chakraborty 401 Reputation points

2021-05-21T16:58:25.64+00:00

@MayankBargali-MSFT No i didn't get the email. I created a Key with 20 days expiry, but didn't get any email. Can you please check my settings, i don't have "Resource Name", "Properties" and "Event Type" like in your screenshot in Inputs. I am pasting my Input and Output Code below for your reference. Please let me know what is the misconfig if any.

Input :

{ "path": "/subscriptions/<My Azure Sub ID>/providers/Microsoft.KeyVault.vaults/resource/eventSubscriptions", "queries": { "x-ms-api-version": "2017-06-15-preview" }, "host": { "connection": { "name": "/subscriptions/<My Azure Sub ID>/resourceGroups/PallabDev/providers/Microsoft.Web/connections/azureeventgrid" } } }

Pallab Chakraborty 401 Reputation points

2021-05-21T16:59:45.5+00:00

{
"headers": {
"Connection": "Close",
"Accept": "/",
"Accept-Encoding": "gzip,deflate",
"Accept-Language": "en",
"Host": "canadacentral.logic.azure.com",
"Referer": "https://management.azure.com/subscriptions/<My Azure Sub ID>/resourcegroups/PallabDev/providers/Microsoft.Logic/workflows/Secret-Reminder/triggers/When_a_resource_event_occurs/run?api-version=2016-10-01",

Pallab Chakraborty 401 Reputation points

2021-05-21T17:02:58.313+00:00

Output View

Pallab Chakraborty 401 Reputation points

2021-05-21T17:04:27.637+00:00

Input View

Pallab Chakraborty 401 Reputation points

2021-05-21T17:49:38.093+00:00

@MayankBargali-MSFT Hi Mayank, actually i am able to resolve the issue now by following the link : https://learn.microsoft.com/en-us/azure/key-vault/general/event-grid-logicapps
Actually i think i created the Logic App wrong way. Instead of going to the Key Vault--> Events, i went to Logic App directly and created the Event Grid topic from there. Somehow that was a problem i guess and the configuration wasn't done in the right way. So now after following the URL, i am getting automatic Email alerts about Key Expiry, Key New Version created etc etc. Appreciate your help

MayankBargali-MSFT 69,581 Reputation points

2021-05-24T03:41:47.623+00:00

@Anonymous Thanks for the update. Both the ways should work until and unless there is a configuration issue while creating it. As I have initially tested with the event grid topic/subscription creation from the logic app when I have configured it. Once you have created the logic app you can always navigate to your resource and verify whether the event grid topic/subscription was created successfully or not. If you face any issue always feel free to reach out to us.
Sign in to comment

Share via

Creating a Logic App to remind Key Vault key Expiry

1 answer