I encuntered a requirement to acquire some unencrypted files from an on premise FTP server and place them on a target Azure Storage Account after first encrypting them. The goal is to not have these files in Azure unless they are encrypted.

This can be achieved in possibly a number of a ways but this post is about using Logic Apps to do this.

Pre-Requisites

The following are assumed to be in place already:

• An accessible FTP Server where the source file is hosted
• An accessible Storage Account where the encrypted file is to be targeted to
• An accessible Key vault with an encryption Key

Create Logic App

I’m going to use Azure Portal to do this.

First type Logic App in the search bar on the dashboard/home screen. Click on Logic App to bring up the screen.

You can see I have already attempted the action but we’ll create a new one for the purposes of writing this post. Hit Add and fill out the details for a new Logic App:

I’ve used an existing resource group but you could create one if needed. I called the Logic App “encrypt-ftp-to-storageaccount”. Hit Review + Create and it will validate before offering the create screen:

Hit Create and the deployment will execute until completion:

Now hit Go to resource and it will bring up the initial screen for the new Logic App…

Scroll down and click on “Blank Logic App”:

Notice that because I’ve already been playing in this area my Recent selections include some of the components we’re going to use here.

We need some kind of simple trigger to kick this off so let’s just use a Schedule with a once a day recurrence. Click on Schedule and then Recurrence and set the Interval to 1 and the Frequency to Day:

Now add a new step – we want to acquire the file from the FTP server.

Click on New Step.

Click on FTP if it is in your recent list or search for it. Then choose Get File Content (or Get File Content With Path if you need to specify a path). You then get the action on the editor with a number of fields to fill out:

Give the Connection a name (e.g. “ftp source”). Set the ftp server address, username and password and port number. I’ve not tried changing any of the other details but some of them might be sensible to address in your own environment. Click Create to create this action.

Now you can select a file – this could be programmed but for this exercise I’m just going to point it at a fixed file (robots.txt):

Now add another step by clicking “+ New Step”:

Choose Azure Key Vault from the Recent (if available) or by searching and then select “Encrypt data with key”. This creates the step:

Depending on whether you are already connected you may see that it tries to use an existing connection or if not asks you to specify the connection to the required Key Vault. In my case above I have a connection but I’ll choose to change that to show what needs to be set. Hitting Change Connection brings up this:

Choose Add New and it shows:

Set the Vault name to the name of the Key Vault where the Key for encryption is held, in my case akv-dev and click Sign In:

Azure brings up the usual credentials access dialog to allow you to connect.

Once connected you get the dialog box to select the Key:

I choose my Key (akv-dev-testkey) and set the Raw Data to the Dynamic Content value of File Content.

Now click on “+ New Step” again to add the write out of the data to the Storage Account.

Choose Azure Blob Storage and Create Blob:

I set the Connection Name and choose the Storage Account (oramossadls2) and then hit Create.

This creates the Create Blob Step and we can specify the folder path on the target Storage Account where we want to create the file. We can specify the target file name (robots.txt) and then we should specify the Dynamic Content of the encrypted data as the Blob Content but notice that the Dynamic Content doesn’t show it. It does, however, show the message “We can’t find any outputs to match this input format. Select See more to see all outputs from previous actions”:

Click on the “See More” and it will show the “encryptedData” as an option:

Choose “encryptedData” so that the Create blob dialog looks like:

Save the Logic App and Run it.

The Logic App runs and the output looks like this:

If we look on the Storage Account we see the file robots.txt:

And if I looked at the file in an editor it looks like:

Hope this helps.