By default, Azure PaaS services are publicly accessible. This means they can be accessed via a public IP address. This doesn’t mean you have authorization to call them, but, from the network’s point of view, they are accessible.
Normally, for demos, this is fine as the point of the demos & demo code is to demonstrate the concept.
However, I do get asked for demos & demo code that uses private networking for all services. This requires that PaaS services have a private endpoint created to remove public network access.
Creating the private endpoints is easy, but the DNS entries & accessing the services from my local computer can be challenging. I need to recreate the stereotypical hub-spoke network design that many large companies implement.
Here is my simple hub-spoke network design.
Therefore, I made a GitHub repo that takes advantage of the following Azure services.
- Virtual Network Gateway
- Private DNS Zones
- DNS Private Resolver
- Policy
- Azure Monitor Private Link Scope
- Managed Identity
- Virtual Network
Virtual Network Gateway
The Virtual Network Gateway provides the Point-2-Site VPN connection that links my local PC to the central hub network. The important part of setting this service up is setting the “Additional routes to advertise” so the RFC 1918 IP addresses (10.0.0.0/8) that are in the spokes are available to be called from your local PC.
Private DNS Zones
You need to set up all the private DNS zones for all the privatelink DNS zones in the hub. The A records that map from every FQDN to the internal IP address of each private endpoint created in every spoke will be created via Azure Policy.
DNS Private Resolver
This service allows your local machine to use an FQDN to hit an Azure service that is behind a private endpoint. This service will resolve the FQDN via the Azure Private DNS Zones and forward the requests to the appropriate spoke.
Without this service, you would have to constantly update your hosts file with the A records for every private endpoint.
I have implemented the “centralized DNS architecture” recommended in this link & this link.
Policy
Azure Policy is used to automatically create the A records for the Private DNS Zones whenever a private endpoint is registered. This automates the process of creating DNS records via Azure Private DNS Zone Groups.
Azure Monitor Private Link Scope
The Azure Monitor Private Link Scope (AMPLS) is a central service that allows the ingestion of logs into Azure Monitor via private endpoints. This needs to be hosted in the hub vNet and linked to via the spoke vNets.
Managed Identity
The managed identity is how the Azure Policy create the appropriate A records. It has the Network Contributor RBAC role.
Virtual Network
Each spoke vNet needs to be peered back to the hub vNet and have its Azure custom DNS server set to the inbound IP address of the DNS Private Resolver service in the hub.
Resolve FQDN of Azure PaaS service using private endpoint
If I deploy an Azure PaaS service behind a private endpoint, I can remove the public endpoint associated with that service. By using the architecture above, I am able to resolve the IP address of the service from my local machine and navigate to it.
Resolve-DnsName wa-test-djazhzhdgzb4d0dn.eastus2-01.azurewebsites.net
Name Type TTL Section NameHost
---- ---- --- ------- --------
wa-test-djazhzhdgzb4d0dn.eastu CNAME 60 Answer wa-test-djazhzhdgzb4d0dn.eastus2-01.privatelink.azurewebsites.net
s2-01.azurewebsites.net
Name : wa-test-djazhzhdgzb4d0dn.eastus2-01.privatelink.azurewebsites.net
QueryType : A
TTL : 10
Section : Answer
IP4Address : 10.0.0.5