|
| 1 | +--- |
| 2 | +title: Manage virtual networks with Private Link - CLI |
| 3 | +description: Create an Azure Database for PostgreSQL - Flexible Server instance with public access by using the Azure CLI, and add private networking to the server based on Azure Private Link. |
| 4 | +author: gennadNY |
| 5 | +ms.author: gennadyk |
| 6 | +ms.service: postgresql |
| 7 | +ms.subservice: flexible-server |
| 8 | +ms.custom: |
| 9 | + - ignite-2023 |
| 10 | +ms.topic: how-to |
| 11 | +ms.date: 03/12/2024 |
| 12 | +--- |
| 13 | + |
| 14 | + |
| 15 | +# Create and manage virtual networks with Private Link for Azure Database for PostgreSQL - Flexible Server by using the Azure CLI |
| 16 | + |
| 17 | +[!INCLUDE [applies-to-postgresql-flexible-server](../includes/applies-to-postgresql-flexible-server.md)] |
| 18 | + |
| 19 | +Azure Database for PostgreSQL flexible server supports two types of mutually exclusive network connectivity methods to connect to your Azure Database for PostgreSQL flexible server instance. The two options are: |
| 20 | + |
| 21 | +* Public access through allowed IP addresses. You can further secure that method by using [Azure Private Link](./concepts-networking-private-link.md)-based networking with Azure Database for PostgreSQL flexible server. The feature is in preview. |
| 22 | +* Private access through virtual network integration. |
| 23 | + |
| 24 | +This article focuses on creating an Azure Database for PostgreSQL flexible server instance with public access (allowed IP addresses) by using the Azure portal. You can then help secure the server by adding private networking based on Private Link technology. |
| 25 | + |
| 26 | +You can use [Private Link](../../private-link/private-link-overview.md) to access the following services over a private endpoint in your virtual network: |
| 27 | + |
| 28 | +* Azure platform as a service (PaaS) services, such as Azure Database for PostgreSQL flexible server |
| 29 | +* Customer-owned or partner services that are hosted in Azure |
| 30 | + |
| 31 | +Traffic between your virtual network and a service traverses the Microsoft backbone network, which eliminates exposure to the public internet. |
| 32 | + |
| 33 | +> [!NOTE] |
| 34 | +> Azure Database for PostgreSQL flexible server supports Private Link based networking in General Availability in following regions: |
| 35 | +> * Canada East |
| 36 | +> * Poland Central |
| 37 | +> * Italy North |
| 38 | +> * South India |
| 39 | +> * UK West |
| 40 | +> * Japan West |
| 41 | +> * France South |
| 42 | +> * Qatar Central |
| 43 | +> * Jio India West |
| 44 | +> * Australia Central |
| 45 | +> * Korea South |
| 46 | +> * Switzerland West |
| 47 | +> * UAE Central |
| 48 | +> * Australia Central 2 |
| 49 | +> * Germany North |
| 50 | +> * Norway West |
| 51 | +> * Brazil Southeast |
| 52 | +> * South Africa West |
| 53 | +> |
| 54 | +> **You can create new Azure Database for PostgreSQL - Flexible Server, with Azure Private Link based networking utilizing Private Endpoints in these above listed regions under General Availability.** |
| 55 | +> **In the rest of Azure regions where Azure Database for PostgreSQL - Flexible Server is available, Azure Database for PostgreSQL flexible server supports Private Link based networking in Preview at this time.** |
| 56 | +> |
| 57 | +> **Important Prerequisite for regions where this feature is in Preview** Azure Database for PostgreSQL flexible server support for Private Endpoints in Preview requires enablement of [**Azure Database for PostgreSQL flexible server Private Endpoint capability** preview feature in your subscription](../../azure-resource-manager/management/preview-features.md). Only **after preview feature is enabled** you can create servers which are PE capable, i.e. can be networked using Private Link. |
| 58 | +
|
| 59 | +## Prerequisites |
| 60 | + |
| 61 | +To add an Azure Database for PostgreSQL flexible server instance to a virtual network by using Private Link, you need: |
| 62 | + |
| 63 | +1. A [virtual network](../../virtual-network/quick-create-portal.md#create-a-virtual-network). The virtual network and subnet should be in the same region and subscription as your Azure Database for PostgreSQL flexible server instance. |
| 64 | + |
| 65 | + Be sure to remove any locks (**Delete** or **Read only**) from your virtual network and all subnets before you add a server to the virtual network, because locks might interfere with operations on the network and DNS. You can reset the locks after server creation. |
| 66 | + |
| 67 | + |
| 68 | +2. You need to sign in to your account using the [az login](/cli/azure/reference-index#az-login) command. Note the **ID** property, which refers to **Subscription ID** for your Azure account. |
| 69 | + |
| 70 | +```azurecli |
| 71 | +az login |
| 72 | +``` |
| 73 | + |
| 74 | +3. Select the specific subscription under your account using [az account set](/cli/azure/account#az-account-set) command. Make a note of the **ID** value from the **az login** output to use as the value for **subscription** argument in the command. If you have multiple subscriptions, choose the appropriate subscription in which the resource should be billed. To get all your subscription, use [az account list](/cli/azure/account#az-account-list). |
| 75 | + |
| 76 | +```azurecli |
| 77 | +az account set --subscription <subscription id> |
| 78 | +``` |
| 79 | + |
| 80 | +## Create an Azure Database for PostgreSQL flexible server instance with a private endpoint |
| 81 | + |
| 82 | +1. Create virtual network, private endpoint, private DNS zone and link it |
| 83 | + |
| 84 | + You can follow this Azure networking [doc](../../private-link/create-private-endpoint-cli.md) to complete these steps. |
| 85 | + |
| 86 | +2. Create PostgreSQL Flexible Server with no public access |
| 87 | + |
| 88 | +```azurecli |
| 89 | +
|
| 90 | +az postgres flexible-server create --resource-group <resource_group_name> --name <server_name> --public-access 'None' |
| 91 | +``` |
| 92 | + |
| 93 | +3. Approve the specified private endpoint connection created in first step associated with a PostgreSQL flexible server. |
| 94 | + |
| 95 | +```azurecli |
| 96 | +az postgres flexible-server private-endpoint-connection approve -g <resource_group> -s <server_name> -n <connection_name> --description "Approve connection" |
| 97 | +``` |
| 98 | + |
| 99 | +## Next steps |
| 100 | + |
| 101 | +* Learn more about [networking in Azure Database for PostgreSQL flexible server with Private Link](./concepts-networking-private-link.md). |
| 102 | +* Understand more about [virtual network integration in Azure Database for PostgreSQL flexible server](./concepts-networking-private.md). |
| 103 | + |
| 104 | + |
0 commit comments