blocks|key|768071|text|您可以将手动触发器端点放在Azure+API+Management后面，使用它的"Restrict+caller+IPs"+policy应该可以帮助您完成所需的任务。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|768072|entityMap|0|LINK|mutability|MUTABLE|url|https://azure.microsoft.com/en-us/services/api-management/|1|https://azure.microsoft.com/en-us/documentation/articles/api-management-howto-policies/^0|D|K|0|14|S|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

You can put the manual trigger endpoint behind <a href="https://azure.microsoft.com/en-us/services/api-management/" rel="nofollow">Azure API Management</a>, using its <a href="https://azure.microsoft.com/en-us/documentation/articles/api-management-howto-policies/" rel="nofollow">"Restrict caller IPs" policy</a> should help you accomplish what you need.

blocks|key|773884|text|我可能错了，但所有应用程序服务(Web应用程序、逻辑应用程序、API应用程序)在默认情况下都是公共可访问的，并且在默认情况下，不会通过Azure资源配置(即逻辑应用程序上的设置)启用IP过滤。我能想到的启用此功能的选项有：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|773885|如果您有权访问逻辑应用程序，请使用元素将流量限制到特定的一组地址(参见MSDN|offset|length|773886|Consider+|unordered-list-item|773887|+Web.config资源和执行IP限制策略(参见Azure+API+Management+Documentation)；我猜这可能不适用于逻辑应用程序，但无论如何都要包括它|ordered-list-item|773888|扩展到高级应用程序服务计划，将逻辑应用程序部署到应用程序服务环境，使您能够指定是否有用于负载平衡请求或内部负载平衡器(用于局域网和Azure之间的跨站点连接)的公共IP+(VIP)；您还可以部署虚拟网络应用程序防火墙，允许您放置显式IP过滤器以及|773889|773890|773891|不知道你的需求，我更倾向于选择3，因为有documentation+supporting+that+scenario+(至少对于网络，移动和应用程序接口应用程序--逻辑应用程序没有提到)。否则，如果您不能修改web.config以包含过滤器，并且不能将API+Management实例放在逻辑应用程序的前面，我不确定您还有什么其他选择。|773892|希望这对你有帮助，如果你找到了解决方案，我也会有兴趣学习的。|773893|entityMap|0|LINK|mutability|MUTABLE|url|https://msdn.microsoft.com/en-us/library/ms691353(v=vs.90%2529.aspx)|1|https://azure.microsoft.com/en-us/services/api-management/|2|https://msdn.microsoft.com/en-us/library/dn894078.aspx#RestrictCallerIPs|3|https://azure.microsoft.com/en-us/documentation/articles/app-service-app-service-environment-control-inbound-traffic/^0|0|Z|4|0|0|0|P|K|1|1A|D|2|0|0|0|0|K|12|3|0|0^^$0|@$1|2|3|4|5|6|7|17|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|18|8|@]|9|@$D|19|E|1A|1|1B]]|A|$]]|$1|F|3|G|5|H|7|1C|8|@]|9|@]|A|$]]|$1|I|3|J|5|K|7|1D|8|@]|9|@$D|1E|E|1F|1|1G]|$D|1H|E|1I|1|1J]]|A|$]]|$1|L|3|M|5|K|7|1K|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|1L|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|1M|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1N|8|@]|9|@$D|1O|E|1P|1|1Q]]|A|$]]|$1|R|3|S|5|6|7|1R|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1S|8|@]|9|@]|A|$]]]|U|$V|$5|W|X|Y|A|$Z|10]]|11|$5|W|X|Y|A|$Z|12]]|13|$5|W|X|Y|A|$Z|14]]|15|$5|W|X|Y|A|$Z|16]]]]

I could be wrong but all App Services (Web Apps, Logic Apps, API Apps) are, by default, publically accessible and, by default, do not enable IP Filtering via Azure resource configuration (meaning, a setting on the Logic App). Options I can think of enabling this would be:

<ol>
<li>If you have access to a Web.config, use an element to restrict traffic to only a specific set of address (see <a href="https://msdn.microsoft.com/en-us/library/ms691353(v=vs.90).aspx" rel="nofollow">MSDN</a>)</li>
<li>Consider putting the Logic App behind an API Management resource and enforce a IP restriction policy (see <a href="https://azure.microsoft.com/en-us/services/api-management/" rel="nofollow">Azure API Management</a> <a href="https://msdn.microsoft.com/en-us/library/dn894078.aspx#RestrictCallerIPs" rel="nofollow">Documentation</a>); I'm guessing this may not apply for Logic Apps but including it anyway</li>
<li>Scale to a Premium App Service Plan, deploy Logic App to an App Service Environment which gives you the ability to specify whether there is a Public IP (VIP) used for load balancing requests or internal load balancer (which would be used for cross-premise connectivity between your LAN and Azure); you can also deploy a virtual Web Application Firewall (WAF) which would allow you to place explicit IP filters as well</li>
</ol>

Not knowing your requirements, I'd lean more towards option 3 simply because there is <a href="https://azure.microsoft.com/en-us/documentation/articles/app-service-app-service-environment-control-inbound-traffic/" rel="nofollow">documentation supporting that scenario</a> (at least for Web, Mobile and API Apps -- Logic Apps are not mentioned). Otherwise, if you're not able to modify the web.config to include the filters and cannot put an API Management instance in front of the logic app, I'm not sure what other options you may have.

Hope this helps and if you find a solution, I'd be interested in learning it as well.

blocks|key|773956|text|请参阅https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|773957|限制传入IP地址除了共享访问签名之外，您可能希望限制仅从特定客户端调用逻辑应用程序。例如，如果你通过Azure+API管理管理你的终结点，你可以限制逻辑应用程序仅在请求来自API管理实例IP地址时接受请求。|773958|可以在逻辑应用程序设置中配置此设置：|773959|在Azure门户中，打开要添加IP地址限制的逻辑应用程序单击设置下的访问控制配置菜单项指定触发器要接受的IP地址范围列表|773960|有效的IP范围采用192.168.1.1/255格式。如果您希望逻辑应用程序仅作为嵌套逻辑应用程序触发，请选择“仅其他逻辑应用程序”选项。此选项将一个空数组写入资源，这意味着只有来自服务本身(父逻辑应用程序)的调用才能成功触发。|773961|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app^0|3|29|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|Y|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|Z|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|10|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]]]

See <a href="https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app</a>

Restrict incoming IP addresses
In addition to the Shared Access Signature, you may wish to restrict calling a logic app only from specific clients. For example, if you manage your endpoint through Azure API Management, you can restrict the logic app to only accept the request when the request comes from the API Management instance IP address.

This setting can be configured within the logic app settings:

In the Azure portal, open the logic app you want to add IP address restrictions
Click the Access control configuration menu item under Settings
Specify the list of IP address ranges to be accepted by the trigger

A valid IP range takes the format 192.168.1.1/255. If you want the logic app to only fire as a nested logic app, select the Only other logic apps option. This option writes an empty array to the resource, meaning only calls from the service itself (parent logic apps) fire successfully.

Is there any way to secure an HTTP endpoint of an Azure Logic App ? 

For example if I'm using my Logic App's HTTP request endpoint to be triggered as a webhook from a payment gateway, I'd want to restrict only certain static IP Addresses to access it and enable HTTPS.

I didn't find any firewall options like those present in Azure SQL for IP base restrictions.

How to secure Azure Logic App http request endpoint

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

有没有办法保护Azure Logic App的HTTP终结点？例如，如果我使用我的Logic App的HTTP请求端点作为webhook从支付网关触发，我希望仅限制某些静态IP地址访问它并启用HTTPS。我没有找到任何像Azure SQL中提供的用于IP基础限制的防火墙选项。

问如何保护Azure Logic App http请求终结点
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何保护Azure Logic App http请求终结点EN