API Connection is failing with 'Forbidden' - azure

Question

I have a logic app inside an ISE which uses an API Connection to write to my storage account. Both ISE and storage account are in the same private VNet and my storage account has firewall rules enabled for each subnet of the ISE. Even so, all requests to the logic app fail to write to blob storage with the error:
{
"status": 403,
"message": "This request is not authorized to perform this operation.\r\nclientRequestId: ...",
"error": {
"message": "This request is not authorized to perform this operation."
},
"source": "azureblob-cus.azconn-cus.p.azurewebsites.net"
}
If I disable the blob storage firewall rules, it can write to the storage account. Why can my logic app-inside the ISE which has firewall rules configured for the storage account-not write to my storage account?

Answer 1

I figured it out. I was creating my API connections against the publicly available blob storage service rather than the managed connector inside my ISE. Instead of having
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"location": "[resourceGroup().location]",
"name": "[parameters('BackupStorageAccountName')]",
"properties": {
...
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azureblob')]"
}
}
}
I needed to have
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"location": "[resourceGroup().location]",
"name": "[parameters('BackupStorageAccountName')]",
"properties": {
...
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Logic/integrationServiceEnvironments/', parameters('iseName'), '/managedApis/azureblob')]"
}
}
}