Azure Networking (2) : Private Endpoints
Private endpoints are somehow extremely Important when it comes to the privacy of the cloud and its security parameter, so with these few words and some pictures, I will explain how someone can create a private resource and still be able to reach it even if when it becomes unreachable from public internet, because the public access will be disabled, which means no public address ip . that will be due to the private endpoint that represents his private resource and the private dns zone that will be linked to.
Scenario :
Let us create a container (blob) in a storage account with the public access open to all networks ,then make the blob publicly available, I will access the blob from internet and form virtual network, and see the result, then I will disable the public access and try to access the blob and see again the result, and if I cannot access, then I will use the private endpoint and private dns zone to get access to my blob.
The resources:
Accessing my container (blob) from public internet :
Accessing my container (blob) from virtual network :
Now I will create a private endpoint and disable the public access for my account storage and then repeat the same previous processes meaning I will try to access my blob again.
Creating private endpoint
below is the preview of the steps I made for Resource options and virtual network and DNS, as you can see, I should select the blob as target sub-resource and if you have other file share you should create private endpoint for it and so on for table and queue. for the step of networking I should set my (virtual network) vnet to which my VM is connected, then for the step of DNS, it is generated automatically.
领英推荐
Disabling the public access for my container (blob)
I go to my storage account then in networking Firewall and virtual networks I disable all public network access and then I save.
Now I will repeat my try to access it from public internet and then from my vnet where my private endpoint, and then I see what will happen.
Accessing my container (blob) from public internet :
Now no access.
Accessing my container (blob) from virtual network :
You can see that when I disabled the public network access for my storage account before creating the private endpoint and tried I could not access, but once I created the endpoint, I was able to access.
I hope this article was useful, and you can leave a comment below if there is something that I did not mention. Thank you