Failed the KeyVault and Power Platform Integration (Private Network).

Question

Good morning MS Team,

This week, I've been trying to configure my Power Platform through a KeyVault to got some secrets, using a private networks by hardening the external access. The tutorial followed is this one: https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-setup-configure#set-up-the-virtual-network-and-subnets where the steps took were "How to run Subnet Injection scripts" https://github.com/microsoft/PowerApps-Samples/tree/master/powershell/enterprisePolicies#how-to-run-subnet-injection-scripts

The funny thing is all resources were created, not Power Shell Script threw errors creating the following Azure resources

Plus, the Power Platform history is saying that I've configured the connection

But, when I am trying to run a script where I am using a KV secret to run my Power Automate script is throwing this error:

rror occured while reading secret: Service request failed.

Status: 403 (Forbidden)

Content:

{"error":{"code":"Forbidden","message":"Connection is not an approved private link and caller was ignored because bypass is not set to 'AzureServices' and PublicNetworkAccess is set to 'Disabled'. \r\nVault: integrationkvpa;location=eastus","innererror":{"code":"ForbiddenByConnection"}}}

Headers:

Pragma: no-cache

x-ms-keyvault-region: eastus

x-ms-client-request-id: f49b65b2-63d1-469a-9be7-3ae047d73ab0

x-ms-request-id: d07b65c8-9756-4df0-8b10-1d22a01a10ab

x-ms-keyvault-service-version: 1.9.1430.6

x-ms-keyvault-network-info: conn_type=Ipv4;addr=40.113.178.209;act_addr_fam=InterNetwork;

X-Content-Type-Options: REDACTED

Strict-Transport-Security: REDACTED

Content-Length: 288

Cache-Control: no-cache

Content-Type: application/json; charset=utf-8

Date: Wed, 01 May 2024 18:14:49 GMT

Expires: -1

I tested:

• If I am opening the KV network: the flow worked
• if I am adding the Allow public access from specific virtual networks and IP addresses and I am adding the thousands Power Automate public IPs, is working https://learn.microsoft.com/en-us/connectors/common/outbound-ip-addresses. But I'd like to avoid this solution adding thousands of IPs and apart from that I 'd prefer not to be updating them.
• 

Am I missing something?, Any ideas why is this integration failing ?, How could I see what is the error to solve it?

Thank you in advance,

Cheers,

Answer 1

Hello Malvaro,

Thank you for posting your question in the Microsoft Q&A Community.

I understand you would like to know how to allow your Power Automate access to your key vault via private network access.

To resolve this, you need to know which IP address range the Power Automate connects from. You might want to get that by looking through this link

https://learn.microsoft.com/en-us/power-platform/admin/online-requirements

However, it might not be that easy to get this IP address. As a workaround, enable Azure key vault logging, set the network to public disabled, and try to initiate the connection. After some hours, you should have a log within the storage account to see from which network the power automation is trying to authenticate. Follow the link below to see the steps to create key vault logging.

https://learn.microsoft.com/en-us/azure/key-vault/general/howto-logging?tabs=azure-cli

You can also take a look at this StackOverflow thread which describes almost the same scenario.

https://stackoverflow.com/questions/74390962/how-to-connect-to-azure-vault-from-microsoft-flow

Let me know if further assistance is required.

Babafemi

Answer 2

HI,

Thank you for taking the time to respond,, following the links shared, and also trying to have a workaround for this topic, I've been creating a JS script to be executed by NodeJS, where taking the file: ServiceTags_Public_20240422.json (https://www.microsoft.com/en-us/download/details.aspx?id=56519), it's creating a PS1 Script to run the KeyVault command to add the network rules. Since allowing public access from specific virtual networks and IP addresses I should manage the region IPs where I am running the Power Platform Infra, and it's a big list.

Shared the code below

const fs = require('fs');
const path = require('path');

// Script variables.
const subscription = "9999-99999-99999-99999-99999";
const resourceGroup = "myrg";
const keyvaultName = "mykv";

// File paths.
const serviceTags_PublicFile = path.join(__dirname, 'ServiceTags_Public_20240422.json');
const psScriptFile = path.join(__dirname, 'AddPowerPlatformIPsToKeyVaultFirewall.ps1');
//Add the missing fs.
fs
readFile(serviceTags_PublicFile, 
'utf8',
(err, data) => {
    if (err) {
      console.error('Error reading file:', err);
      return;
    }
  
    // Parse the JSON data.
    const jsonData = JSON.parse(data);
  
    // Array of ServiceTagNames (choose your region).
    const ServiceTagNames = ['PowerPlatformInfra.CanadaEast', 'PowerPlatformInfra.CanadaCentral'];
    var addressPrefixes = []; 
    //Creating the IP range list.
    ServiceTagNames.forEach(name => {
      addressPrefixes = addressPrefixes.concat(jsonData.values.find(value => value.name === name).properties.addressPrefixes);
    });
    let commands = [];
	//Creating the basic az commands.
    commands = commands.concat(`az login`);
    commands = commands.concat(`az account set --subscription '${subscription}'`);
    commands = commands.concat(`Write-Host 'Adding the following ServiceTagNames: ${ServiceTagNames.join(" , ")}'`);
	// Create the az command to add the network rule and the progress message.
    addressPrefixes.forEach((ip, index) => {
        const percentComplete = (index/addressPrefixes.length) * 100;
        commands = commands.concat(`Write-Progress -Activity 'Adding IP to KeyVault' -Status 'Adding IP: ${ip}' -PercentComplete ${percentComplete}`);
        commands = commands.concat(`az keyvault network-rule add --name '${keyvaultName}' --resource-group '${resourceGroup}' --ip-address ${ip}`);
    });
	// Creates the final PS1 script.
//Add the missing fs.
    fs
writeFile(psScriptFile, 
commands.join('\n'), 
(err) => {
        if (err) {
            console.error('Error writing file:', err);
        } else {
            console.log('Successfully wrote all Azure commands');
        }
    });
});

Output example:

And having this

Now my Power Automate Scripts are working as expected by adding the 2 Power Platform region IPs.

However, I would like to emphasise that this option https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-setup-configure#set-up-the-virtual-network-and-subnets is not valid, because I could achieve this point without having the 2 VNETs, the policy, and the integration.... And in the end, I am not using the private IPs with the range 10.0.0.0/24....

Questions: Am I missing something? Is this feature really enable?

Thank you in advance,

Cheers,