Access control configuration of Logic App changing after CI-CD deployment

Question

Hi All,

I have set Access control configuration in workflow settings as "Only other Logic App" for my logic app.

But when i am performing CI-CD deployment for this logic app which includes it's arm template deployment, the access control configuration is getting reverted to "Any IP"

Tried with "Specific IP" option and again after deployment, the setting is getting reverted to "Any IP"

Is there a way to handle this in Arm template?

If not then can we add some task in CI-CD pipeline to update this setting after deployment?

Answer 1

@Priya Jha Thanks for reaching out. Yes, you can define the Access control setting on your consumption logic app using the ARM template. This document already covers it in detail.

In your ARM template, specify the allowed inbound IP address ranges in your logic app's resource definition by using the accessControl section. In this section, use the triggers, actions, and the optional contents sections as appropriate by including the allowedCallerIpAddresses section with the addressRange property and set the property value to the allowed IP range in x.x.x.x/x or x.x.x.x-x.x.x.x format.

• If your nested logic app uses the Only other Logic Apps option, which permits inbound calls only from other logic apps that use the built-in Azure Logic Apps action, set the allowedCallerIpAddresses property to an empty array ([]), and omit the addressRange property.
• If your nested logic app uses the Specific IP ranges option for other inbound calls, such as other logic apps that use the HTTP action, include the allowedCallerIpAddresses section, and set the addressRange property to the allowed IP range.

For specific IP:

 "accessControl": {
               "triggers": {
                  "allowedCallerIpAddresses": [
                     {
                        "addressRange": "192.168.12.0/23"
                     }
                  ]
               },
               "actions": {
                  "allowedCallerIpAddresses": [
                     {
                        "addressRange": "192.168.12.0/23"
                     }
                  ]
               }
            }

For only other logic app:

"accessControl": {
               "triggers": {
                  "allowedCallerIpAddresses": []
               },
               "actions": {
                  "allowedCallerIpAddresses": []
               },
               // Optional
               "contents": {
                  "allowedCallerIpAddresses": []
               }

Please leverage the document and above same section for accessControl parameter. Feel free to get back to me if you need any assistance.

Please accept as "Yes" if the answer is helpful so that it can help others in the community. If you need any help/clarification/concerns/follow up questions, then please click on "Add Comment" on my answer and provide more details.