You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Access Key Vault in private network through Shared Private Endpoints
2
+
title: Access a key vault in a private network via shared private endpoints
3
3
titleSuffix: Azure Web PubSub Service
4
-
description: How to access key vault in private network through Shared Private Endpoints
4
+
description: Learn how to access a key vault in private network through shared private endpoints.
5
5
author: ArchangelSDY
6
6
ms.service: azure-web-pubsub
7
7
ms.custom: devx-track-azurecli
8
8
ms.topic: how-to
9
-
ms.date: 03/27/2023
9
+
ms.date: 08/16/2024
10
10
ms.author: dayshen
11
11
---
12
12
13
-
# Access Key Vault in private network through shared private endpoints
13
+
# Access a key vault in a private network through shared private endpoints
14
14
15
-
Azure Web PubSub Service can access your Key Vault in a private network through shared private endpoints connections. This article shows you how to configure your Web PubSub service instance to route outbound calls to a key vault through a shared private endpoint rather than public network.
15
+
Azure Web PubSub can access a key vault in a private network through shared private endpoint connections. This article shows you how to configure your Web PubSub resource to route outbound calls to a key vault through a shared private endpoint instead of through a public network.
Private endpoints of secured resources created through Azure Web PubSub Service APIs are referred to as *shared private-link resources*. This is because you're "sharing" access to a resource, such as an Azure Key Vault, that has been integrated with the [Azure Private Link service](../private-link/private-link-overview.md). These private endpoints are created inside the Azure Web PubSub Service execution environment and aren't directly visible to you.
19
+
Private endpoints of secured resources created through Azure Web PubSub APIs are called *shared privatelink resources*. You "share" access to a resource, such as an instance of Azure Key Vault, that is integrated with [Azure Private Link](../private-link/private-link-overview.md). These private endpoints are created inside the Web PubSub execution environment and aren't directly visible to you.
20
20
21
21
> [!NOTE]
22
22
> The examples in this article use the following resource IDs:
23
23
>
24
-
> * The resource ID of this Azure Web PubSub Service is _/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.SignalRService/webpubsub/contoso-webpubsub.
25
-
> * The resource ID of Azure Key Vault is */subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.KeyVault/vaults/contoso-kv*.
24
+
> * The resource ID of this Azure Web PubSub instance is `_/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.SignalRService/webpubsub/contoso-webpubsub`.
25
+
> * The resource ID of the Azure Key Vault instance is `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.KeyVault/vaults/contoso-kv`.
26
26
>
27
-
> When following the steps, substitute the resource IDs of your Azure Web PubSub Service and Azure Key Vault.
27
+
> To use the steps in the following examples, replace these values with your own subscription ID, the name of your Web PubSub resource, and the name of your Azure Key Vault resource.
28
28
29
29
## Prerequisites
30
30
31
-
* An Azure subscription, if you don't have one, create a [free account].(<https://azure.microsoft.com/free/?WT.mc_id=A261C142F>).
32
-
*[Azure CLI](/cli/azure/install-azure-cli) 2.25.0 or later (if using Azure CLI)._
33
-
* An Azure Web PubSub Service instance in a **Standard** pricing tier or higher
31
+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
32
+
*The [Azure CLI](/cli/azure/install-azure-cli) 2.25.0 or later (if you use the Azure CLI).
33
+
* An Azure Web PubSub instance in a minimum Standard pricing tier.
34
34
* An Azure Key Vault resource.
35
35
36
-
### 1. Create a shared private endpoint resource to the Key Vault
36
+
### Create a shared private endpoint resource to the key vault
37
37
38
38
#### [Azure portal](#tab/azure-portal)
39
39
40
-
1. In the Azure portal, go to your Azure Web PubSub Service resource page.
41
-
1.Select **Networking** from the menu.
40
+
1. In the Azure portal, go to your Azure Web PubSub resource.
1.Enter a **Name** for the shared private endpoint.
48
-
1. Enter your key vault resource by choosing **Select from your resources** and selecting your resource from the lists, or by choosing **Specify resource ID** and entering your key vault resource ID.
49
-
1.Enter *please approve* for the **Request message**.
47
+
1.For **Name**, enter a name to use for the shared private endpoint.
48
+
1. Enter your key vault resource: Choose **Select from your resources** and then select your resource from the lists, or select **Specify resource ID** and enter your key vault resource ID.
49
+
1.For **Request message**, enter **please approve**.
50
50
1. Select **Add**.
51
51
52
52
:::image type="content" alt-text="Screenshot of adding a shared private endpoint." source="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-add.png" :::
53
53
54
-
The shared private endpoint resource provisioning state is **Succeeded**. The connection state is **Pending** approval at target resource side.
54
+
The shared private endpoint resource provisioning state is **Succeeded**. The connection state is **Pending**and waiting for approval for the target resource.
55
55
56
-
:::image type="content" alt-text="Screenshot of an added shared private endpoint." source="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-added.png" lightbox="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-added.png" :::
56
+
:::image type="content" alt-text="Screenshot of an added shared private endpoint." source="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-added.png" lightbox="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-added.png" :::
57
57
58
58
#### [Azure CLI](#tab/azure-cli)
59
59
60
-
You can make the following API call with the [Azure CLI](/cli/azure/) to create a shared private link resource. Replace the `uri` with your own value.
60
+
You can make the following API call with the [Azure CLI](/cli/azure/) to create a shared private link resource. Replace the value `uri` with the URI in your scenario.
61
61
62
62
```azurecli
63
63
az rest --method put --uri https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.SignalRService/webpubsub/contoso-webpubsub/sharedPrivateLinkResources/kv-pe?api-version=2022-08-01-preview --body @create-pe.json
64
64
```
65
65
66
-
The contents of the *create-pe.json* file, which represents the request body to the API, are as follows:
66
+
The contents of the *create-pe.json* file represent the request body to the API:
67
67
68
68
```json
69
69
{
@@ -76,54 +76,54 @@ The contents of the *create-pe.json* file, which represents the request body to
76
76
}
77
77
```
78
78
79
-
The process of creating an outbound private endpoint is a long-running (asynchronous) operation. As in all asynchronous Azure operations, the `PUT` call returns an `Azure-AsyncOperation` header value that looks like the following output:
79
+
The process of creating an outbound private endpoint is a long-running (asynchronous) operation. As in all asynchronous Azure operations, the PUT call returns an `Azure-AsyncOperation` header value that looks like the following example:
You can poll this URI periodically to obtain the status of the operation. Wait for the status to change to "Succeeded" before proceeding to the next steps.
85
+
You can poll this URI periodically to get the status of the operation. Wait for the status to change to "Succeeded" before you proceed to the next section.
86
86
87
-
You can poll for the status by manually querying the `Azure-AsyncOperationHeader` value:
87
+
To poll for the status, manually query the `Azure-AsyncOperationHeader` value:
88
88
89
89
```azurecli
90
90
az rest --method get --uri https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.SignalRService/webpubsub/contoso-webpubsub/operationStatuses/c0786383-8d5f-4554-8d17-f16fcf482fb2?api-version=2022-08-01-preview
91
91
```
92
92
93
93
-----
94
94
95
-
### 2. Approve the private endpoint connection for the Key Vault
95
+
### Approve the private endpoint connection for the key vault
96
96
97
-
After the private endpoint connection has been created, you need to approve the connection request from the Azure Web PubSub Service in your key vault resource.
97
+
After the private endpoint connection is created, you need to approve the connection request from Web PubSub in your Key Vault resource.
98
98
99
99
#### [Azure portal](#tab/azure-portal)
100
100
101
-
1. In the Azure portal, go to your key vault resource page.
102
-
1.Select **Networking** from the menu.
101
+
1. In the Azure portal, go to your Key Vault resource.
102
+
1.On the left menu, select **Networking**.
103
103
1. Select **Private endpoint connections**.
104
104
105
105
:::image type="content" alt-text="Screenshot of the Azure portal, showing the Private endpoint connections pane." source="media\howto-secure-shared-private-endpoints-key-vault\portal-key-vault-approve-private-endpoint.png" :::
106
106
107
-
1. Select the private endpoint that Azure Web PubSub Service created.
108
-
1. Select **Approve** and **Yes** to confirm.
107
+
1. Select the private endpoint that Web PubSub created.
108
+
1. Select **Approve** and then select **Yes** to confirm.
109
109
1. Wait for the private endpoint connection to be approved.
110
110
111
111
:::image type="content" alt-text="Screenshot of the Azure portal, showing an Approved status on the Private endpoint connections pane." source="media\howto-secure-shared-private-endpoints-key-vault\portal-key-vault-approved-private-endpoint.png" :::
112
112
113
113
#### [Azure CLI](#tab/azure-cli)
114
114
115
-
1. List private endpoint connections.
115
+
1. List private endpoint connections:
116
116
117
117
```azurecli
118
118
az network private-endpoint-connection list --name <key-vault-resource-name> --resource-group <key-vault-resource-group-name> --type 'Microsoft.KeyVault/vaults'
119
119
```
120
120
121
-
There should be a pending private endpoint connection. Note its `id`.
121
+
Check for a pending private endpoint connection. Note the connection ID.
122
122
123
123
```json
124
124
[
125
125
{
126
-
"id": "<id>",
126
+
"id": "<ID>",
127
127
"location": "",
128
128
"name": "",
129
129
"properties": {
@@ -137,22 +137,22 @@ After the private endpoint connection has been created, you need to approve the
137
137
]
138
138
```
139
139
140
-
1. Approve the private endpoint connection.
140
+
1. Approve the private endpoint connection:
141
141
142
142
```azurecli
143
-
az network private-endpoint-connection approve --id <private-endpoint-connection-id>
143
+
az network private-endpoint-connection approve --id <private-endpoint-connection-ID>
144
144
```
145
145
146
146
-----
147
147
148
-
### 3. Query the status of the shared private link resource
148
+
### Query the status of the shared private link resource
149
149
150
-
It takes a few minutes for the approval to be propagated to Azure Web PubSub Service. You can check the state using either Azure portal or Azure CLI. The shared private endpoint between Azure Web PubSub Service and Azure Key Vault is active when the container state is approved.
150
+
It takes a few minutes for the approval to be propagated to Azure Web PubSub Service. You can check the state using either Azure portal or Azure CLI. The shared private endpoint between Azure Web PubSub Service and Azure Key Vault is active when the container state is approved.
151
151
152
152
#### [Azure portal](#tab/azure-portal)
153
153
154
-
1. Go to the Azure Web PubSub Service resource in the Azure portal.
155
-
1. Select **Networking** from the menu.
154
+
1. In the Azure portal, go to your Azure Web PubSub resource.
155
+
1. On the left menu, select **Networking**.
156
156
1. Select **Shared private link resources**.
157
157
158
158
:::image type="content" alt-text="Screenshot of an approved shared private endpoint." source="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-approved.png" lightbox="media\howto-secure-shared-private-endpoints-key-vault\portal-shared-private-endpoints-approved.png" :::
@@ -163,7 +163,7 @@ It takes a few minutes for the approval to be propagated to Azure Web PubSub Ser
163
163
az rest --method get --uri https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/contoso/providers/Microsoft.SignalRService/webpubsub/contoso-webpubsub/sharedPrivateLinkResources/func-pe?api-version=2022-08-01-preview
164
164
```
165
165
166
-
This command would return a JSON, where the connection state would show up as "status" under the "properties" section.
166
+
This command returns JSON. The connection state is indicated as `status` under `properties`.
167
167
168
168
```json
169
169
{
@@ -179,15 +179,13 @@ This command would return a JSON, where the connection state would show up as "s
179
179
180
180
```
181
181
182
-
When the "Provisioning State" (`properties.provisioningState`) of the resource is `Succeeded` and "Connection State" (`properties.status`) is `Approved`, the shared private link resource is functional, and Azure Web PubSub Service can communicate over the private endpoint.
182
+
When `properties.provisioningState`is `Succeeded` and `properties.status` (connection state) is `Approved`, the shared private link resource is functional, and Web PubSub can communicate over the private endpoint.
183
183
184
184
-----
185
185
186
-
Now you can configure features like a custom domain as usual. You don't have to use a special domain for Key Vault. The Azure Web PubSub Service automatically handles DNS resolution.
186
+
Now you can configure features like a custom domain as you typically would. You don't have to use a special domain for your key vault. Web PubSub automatically handles DNS resolution.
187
187
188
-
## Next steps
188
+
## Related conte
189
189
190
-
Learn more:
191
-
192
-
*[What are private endpoints?](../private-link/private-endpoint-overview.md)
190
+
*[What is a private endpoint?](../private-link/private-endpoint-overview.md)
193
191
*[Configure a custom domain](howto-custom-domain.md)
0 commit comments