You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/key-vault/private-link-service.md
+44-38Lines changed: 44 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,87 +11,96 @@ ms.topic: quickstart
11
11
12
12
# Integrate Key Vault with Azure Private Link (Preview)
13
13
14
-
You can use Azure Private Link Service to securely establish a private connection between your Azure resources and key vault. Azure Private Link Service enables you to access Azure Services (for example, Azure Key Vault, Azure Storage, and Azure Cosmos DB) and Azure hosted customer/partner services over a Private Endpoint in your virtual network. For more information, see [What is Azure Private Link? (Preview)](../private-link/private-link-overview.md).
14
+
Azure Private Link Service enables you to access Azure Services (for example, Azure Key Vault, Azure Storage, and Azure Cosmos DB) and Azure hosted customer/partner services over a Private Endpoint in your virtual network.
15
15
16
-
An Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. The private endpoint uses a private IP address from your VNet, effectively bringing the service into your VNet.
16
+
An Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. The private endpoint uses a private IP address from your VNet, effectively bringing the service into your VNet. All traffic to the service can be routed through the private endpoint, so no gateways, NAT devices, ExpressRoute or VPN connections, or public IP addresses are needed. Traffic between your virtual network and the service traverses over the Microsoft backbone network, eliminating exposure from the public Internet. You can connect to an instance of an Azure resource, giving you the highest level of granularity in access control.
17
17
18
-
All traffic to the service can be routed through the private endpoint, so no gateways, NAT devices, ExpressRoute or VPN connections, or public IP addresses are needed. Traffic between your virtual network and the service traverses over the Microsoft backbone network, eliminating exposure from the public Internet. You can connect to an instance of an Azure resource, giving you the highest level of granularity in access control.
18
+
For more information, see [What is Azure Private Link (Preview)?](../private-link/private-link-overview.md).
19
19
20
-
Prerequisite:
20
+
## Prerequisites
21
21
22
-
1. An Azure Key Vault.
22
+
To integrate a key vault with Azure Private Link (Preview), you will need the following:
23
+
24
+
1. A key vault.
23
25
1. An Azure virtual network.
24
26
1. A subnet in the virtual network.
25
27
1. Owner or contributor permissions for both the key vault and the virtual network.
26
28
27
-
Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your key vault can be in a different region.
29
+
Your private endpoint and virtual network must be in the same region. When you select a region for the private endpoint using the portal, it will automatically filter only virtual networks that are in that region. Your key vault can be in a different region.
28
30
29
-
Your private endpoint uses a private IP address in your virtual network.
31
+
Your private endpoint uses a private IP address in your virtual network.
30
32
31
-
## How to create a private link connection to key vault
33
+
## Create a private link connection to key vault
32
34
33
35
First, create a Virtual Network by following the steps in [Create a virtual network using the Azure portal](../virtual-network/quick-create-portal
34
36
.md)
35
37
36
-
Then create a new key Vault by following the steps in [Set and retrieve a secret from Azure Key Vault using the Azure portal](quick-create-portal.md)
38
+
You can either create a new key vault and create a private link connection, or create a private link connection to an existing key vault.
39
+
40
+
### Create a new key vault and create a private link connection
37
41
38
-
After configuring vault basics, select the Networking tab.
42
+
You can create a new key Vault by following the steps in [Set and retrieve a secret from Azure Key Vault using the Azure portal](quick-create-portal.md)
43
+
44
+
After configuring vault basics, select the Networking tab and follow these steps:
39
45
40
46
1. Select the Private Endpoint (preview) radio button in the Networking tab.
41
47
1. Click the "+ Add" Button to add a private endpoint.
42
48
43
-
49
+
44
50
45
51
1. In the "Location" field of the Create Private Endpoint Blade, select the region in which your virtual network is located.
46
52
1. In the "Name" field, create a descriptive name that will allow you to identify this private endpoint.
47
53
1. Select the virtual network and subnet you want this private endpoint to be created in from the dropdown menu.
48
54
1. Leave the "integrate with the private zone DNS" option unchanged.
49
55
1. Select "Ok"
50
56
51
-
57
+
52
58
53
59
54
60
You will now be able to see the configured private endpoint. You now have the option to delete and edit this private endpoint.
55
61
Select the "Review + Create" button and create the key vault. It will take approximately 5-10 minutes for the deployment to complete.
56
62
57
-
Step 2 – Option B: Use existing Key Vault and Create new Private Endpoint
58
-
1. Log in to the Azure Portal.
63
+
### Create a private link connection to an existing key vault
64
+
65
+
If you already have a key vault, you can create a private link connection to it by following these steps:
66
+
67
+
1. Sign in to the Azure portal.
59
68
1. In the search bar, type in "key vaults"
60
-
1. Select the key vault which you want to add a private endpoint to from the list.
69
+
1. Select the key vault which you want to add a private endpoint to from the list.
61
70
1. Select the "Networking" tab under Settings
62
71
1. Select the Private endpoint connections (preview) tab at the top of the page
63
72
1. Select the "+ Private Endpoint" button at the top of the page.
64
73
65
74
66
75
67
-
76
+
68
77
Please note, you can choose to create a private endpoint for any Azure resource in using this blade. You can either use the dropdown menus to select a resource type and select a resource in your directory, or you can connect to any Azure resource using a resource ID. Leave the "integrate with the private zone DNS" option unchanged.
69
78
70
79
71
80
72
81
73
82
## Manage Private Link Connection
74
83
75
-
When you create a private endpoint, the connection must be approved. If the resource you are creating a private endpoint for is in your directory, you will be able to approve the connection request provided you have sufficient permissions. If you are connecting to an Azure resource in another directory, you must wait for the owner of that resource to approve your connection request.
84
+
When you create a private endpoint, the connection must be approved. If the resource you are creating a private endpoint for is in your directory, you will be able to approve the connection request provided you have sufficient permissions. If you are connecting to an Azure resource in another directory, you must wait for the owner of that resource to approve your connection request.
76
85
77
86
What do the various provisioning states mean?
78
87
79
88
| Service Provide Action | Service Consumer Private Endpoint State | Description |
80
89
|--|--|--|
81
90
| None | Pending | Connection is created manually and is pending approval from the Private Link resource owner. |
82
91
| Approve | Approved | Connection was automatically or manually approved and is ready to be used. |
83
-
| Reject | Rejected | Connection was rejected by the private linl resource owner. |
92
+
| Reject | Rejected | Connection was rejected by the private link resource owner. |
84
93
| Remove | Disconnected | Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean up. |
85
94
86
95
### How to manage a private endpoint connections to key vault
87
96
88
-
1. Log in to the Azure Portal.
97
+
1. Log in to the Azure Portal.
89
98
1. In the search bar, type in "key vaults"
90
-
1. Select the key vault which you want to manage.
91
-
1. Select the "Networking" tab.
99
+
1. Select the key vault which you want to manage.
100
+
1. Select the "Networking" tab.
92
101
1. If there are any connections that are pending, you will see a connection listed with "Pending" in the provisioning state.
93
-
1. Select the private endpoint you wish to approve.
94
-
1. Select the approve button.
102
+
1. Select the private endpoint you wish to approve
103
+
1. Select the approve button.
95
104
1. If there are any private endpoint connections you want to reject, whether it is a pending request or existing connection, select the connection and click the "Reject" button.
96
105
97
106
@@ -108,20 +117,21 @@ In the "Networking" tab:
108
117
1. In the "NIC network security group", select "None".
109
118
1. In the "Load balancing", select "No".
110
119
111
-
Open the command line and run the following command:
112
-
``console
120
+
Open the command line and run the following command:
121
+
122
+
```console
113
123
nslookup <your-key-vault-name>.vault.azure.net
114
124
```
115
125
116
126
If you run the ns lookup command to resolve the IP address of a key vault over a public endpoint, you will see a result that looks like this:
0 commit comments