LogicAppsUX icon indicating copy to clipboard operation
LogicAppsUX copied to clipboard

Failed to create standard Logic Apps

Open peter-zhijia-zheng opened this issue 7 months ago • 0 comments

Describe the Bug with repro steps

When I create a Standard Logic Apps in Azure Portal, it will report below error, is it because the impact of security wave related change? I used new resource group and storage account to create it, the other params I'm using the default value, the creation of Standard Logic Apps shouldn't be failed.

{"code":"InvalidTemplateDeployment","details":[{"code":"RequestDisallowedByPolicy","target":"projectcuttle86ea","message":"Resource 'projectcuttle86ea' was disallowed by policy. (Code: RequestDisallowedByPolicy)","additionalInfo":[{"type":"PolicyViolation","info":{"evaluationDetails":{"evaluatedExpressions":[{"result":"True","expressionKind":"Field","expression":"type","path":"type","expressionValue":"Microsoft.Storage/storageAccounts","targetValue":"Microsoft.Storage/storageAccounts","operator":"Equals"},{"result":"False","expressionKind":"Field","expression":"id","path":"id","expressionValue":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52/resourceGroups/ProjectCuttle/providers/Microsoft.Storage/storageAccounts/projectcuttle86ea","targetValue":"/resourceGroups/aro-","operator":"Contains"},{"result":"False","expressionKind":"Field","expression":"Microsoft.Storage/storageAccounts/allowBlobPublicAccess","path":"properties.allowBlobPublicAccess","targetValue":"false","operator":"Equals"}]},"policyDefinitionId":"/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751","policySetDefinitionId":"/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8","policyDefinitionReferenceId":"StorageDisallowPublicAccess","policySetDefinitionName":"1f3afdf9-d0c9-4c3d-847f-89da613e70a8","policySetDefinitionDisplayName":"Microsoft cloud security benchmark","policyDefinitionName":"4fa4b6c0-31ca-4c0d-b10d-24b96f62a751","policyDefinitionDisplayName":"Storage account public access should be disallowed","policyDefinitionEffect":"deny","policyAssignmentId":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn","policyAssignmentName":"SecurityCenterBuiltIn","policyAssignmentDisplayName":"ASC Default (subscription: 2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52)","policyAssignmentScope":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52","policyAssignmentParameters":{"secretsExpirationSetEffect":"Audit","keysExpirationSetEffect":"Audit","certificatesValidityPeriodMonitoringEffect":"audit","publicNetworkAccessOnAzureSQLDatabaseShouldBeDisabledMonitoringEffect":"Deny","azureCosmosDbAccountsShouldHaveLocalAuthenticationMethodsDisabledMonitoringEffect":"Deny","cognitiveServicesAccountsShouldRestrictNetworkAccessMonitoringEffect":"Deny","disallowPublicBlobAccessEffect":"deny"},"policyExemptionIds":[]}},{"type":"PolicyViolation","info":{"evaluationDetails":{"evaluatedExpressions":[{"result":"True","expressionKind":"Field","expression":"type","path":"type","expressionValue":"Microsoft.Storage/storageAccounts","targetValue":"Microsoft.Storage/storageAccounts","operator":"Equals"},{"result":"True","expressionKind":"Field","expression":"Microsoft.Storage/storageAccounts/allowSharedKeyAccess","path":"properties.allowSharedKeyAccess","expressionValue":"****","targetValue":"false","operator":"Exists"}]},"policyDefinitionId":"/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54","policySetDefinitionId":"/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8","policyDefinitionReferenceId":"storageAccountsShouldPreventSharedKeyAccess","policySetDefinitionName":"1f3afdf9-d0c9-4c3d-847f-89da613e70a8","policySetDefinitionDisplayName":"Microsoft cloud security benchmark","policyDefinitionName":"8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54","policyDefinitionDisplayName":"Storage accounts should prevent shared key access","policyDefinitionEffect":"deny","policyAssignmentId":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn","policyAssignmentName":"SecurityCenterBuiltIn","policyAssignmentDisplayName":"ASC Default (subscription: 2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52)","policyAssignmentScope":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52","policyAssignmentParameters":{"secretsExpirationSetEffect":"Audit","keysExpirationSetEffect":"Audit","certificatesValidityPeriodMonitoringEffect":"audit","publicNetworkAccessOnAzureSQLDatabaseShouldBeDisabledMonitoringEffect":"Deny","azureCosmosDbAccountsShouldHaveLocalAuthenticationMethodsDisabledMonitoringEffect":"Deny","cognitiveServicesAccountsShouldRestrictNetworkAccessMonitoringEffect":"Deny","disallowPublicBlobAccessEffect":"deny"},"policyExemptionIds":[]}}],"policyDetails":[{"isInitiative":true,"assignmentId":"/subscriptions/2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn","assignmentName":"ASC Default (subscription: 2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52)","auxDefinitions":[{"definitionName":"Storage account public access should be disallowed","nonComplianceMessage":null},{"definitionName":"Storage accounts should prevent shared key access","nonComplianceMessage":null}],"viewDetailsUri":"https://ms.portal.azure.com#blade/Microsoft_Azure_Policy/EditAssignmentBladeV2/assignmentId/%2fsubscriptions%2f2e8d4cf4-bf0b-48ba-bd16-c06ef4dcbc52%2fproviders%2fMicrosoft.Authorization%2fpolicyAssignments%2fSecurityCenterBuiltIn"}]}],"message":"The template deployment failed because of policy violation. Please see details for more information."}

What type of Logic App Is this happening in?

Standard (Portal)

Are you using new designer or old designer

New Designer

Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg

Yes

Workflow JSON

No response

Screenshots or Videos

No response

Browser

edge, chrome

Additional context

No response

peter-zhijia-zheng avatar Jul 26 '24 02:07 peter-zhijia-zheng