Skip to content

Commit 9632faa

Browse files
denreadenrea
authored
Merge pull request #281910 from KarlErickson/karler-haoozhang
edit "[Azure Spring Apps] Add a section to explain central DNS resolution for private storage access feature #281506"
2 parents 6d9772f + c2cb9da commit 9632faa

File tree

1 file changed

+129
-4
lines changed

1 file changed

+129
-4
lines changed

‎articles/spring-apps/enterprise/how-to-private-network-access-backend-storage.md

Lines changed: 129 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: KarlErickson
55
ms.author: haozhan
66
ms.service: spring-apps
77
ms.topic: how-to
8-
ms.date: 05/01/2024
8+
ms.date: 07/25/2024
99
ms.custom: devx-track-java, devx-track-extended-java, devx-track-azurecli
1010
---
1111

@@ -56,7 +56,7 @@ There are two sets of private link resources deployed in the resource group, eac
5656

5757
- A private endpoint that represents the backend storage account's private endpoint.
5858
- A network interface (NIC) that maintains a private IP address within the service runtime subnet.
59-
- A private DNS zone that's deployed for your virtual network, with a DNS A record also created for the storage account within this DNS zone.
59+
- A private DNS zone deployed for your virtual network, with a DNS A record also created for the storage account within this DNS zone.
6060

6161
> [!IMPORTANT]
6262
> The resource groups are fully managed by the Azure Spring Apps service. Don't manually delete or modify any resource inside these resource groups.
@@ -72,6 +72,130 @@ az spring update \
7272
--enable-private-storage-access <true-or-false>
7373
```
7474

75+
## Use central DNS resolution
76+
77+
A centralized DNS management architecture is documented in the hub and spoke network architecture in [Private Link and DNS integration at scale](/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale). In this architecture, all private DNS zones are deployed and managed centrally in a different central virtual network than the Azure Spring Apps service instance. If you're using this architecture, you can enable central DNS resolution for private storage access by configuring the DNS settings appropriately. This setup ensures that:
78+
79+
- When a private endpoint is created, the corresponding DNS records are automatically added to the centralized private DNS zone.
80+
- DNS records are managed according to the lifecycle of the private endpoint, meaning they are automatically removed when the private endpoint is deleted.
81+
82+
The following sections explain how to enable central DNS resolution for Azure Storage blobs by using [Azure Policy](/azure/governance/policy/overview), assuming you already have the private DNS zone `privatelink.blob.core.windows.net` set up in the central virtual network. The same principles apply to Azure Storage files and other Azure services that support Private Link.
83+
84+
### Policy definition
85+
86+
In addition to the private DNS zone, you need to create a custom Azure Policy definition. For more information, see [Tutorial: Create a custom policy definition](/azure/governance/policy/tutorials/create-custom-policy-definition). This definition automatically creates the required DNS record in the central private DNS zone when you create a private endpoint.
87+
88+
The following policy is triggered when you create a private endpoint resource with a service-specific `groupId`. The `groupId` is the ID of the group obtained from the remote resource or service that this private endpoint should connect to. In this example, the `groupId` for Azure Storage blobs is `blob`. For more information on the `groupId` for other Azure services, see the tables in [Azure Private Endpoint private DNS zone values](../../private-link/private-endpoint-dns.md), under the **Subresource** column.
89+
90+
The policy then triggers a deployment of a `privateDNSZoneGroup` within the private endpoint, which associates the private endpoint with the private DNS zone specified as the parameter. In the following example, the private DNS zone resource ID is `/subscriptions/<subscription-id>/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net`:
91+
92+
```json
93+
{
94+
"mode": "Indexed",
95+
"policyRule": {
96+
"if": {
97+
"allOf": [
98+
{
99+
"field": "type",
100+
"equals": "Microsoft.Network/privateEndpoints"
101+
},
102+
{
103+
"value": "[contains(resourceGroup().name, 'ap-res_')]",
104+
"equals": "true"
105+
},
106+
{
107+
"count": {
108+
"field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
109+
"where": {
110+
"field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
111+
"equals": "blob"
112+
}
113+
},
114+
"greaterOrEquals": 1
115+
}
116+
]
117+
},
118+
"then": {
119+
"effect": "deployIfNotExists",
120+
"details": {
121+
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
122+
"evaluationDelay": "AfterProvisioningSuccess",
123+
"roleDefinitionIds": [
124+
"/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
125+
],
126+
"deployment": {
127+
"properties": {
128+
"mode": "incremental",
129+
"template": {
130+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
131+
"contentVersion": "1.0.0.0",
132+
"parameters": {
133+
"privateDnsZoneId": {
134+
"type": "string"
135+
},
136+
"privateEndpointName": {
137+
"type": "string"
138+
},
139+
"location": {
140+
"type": "string"
141+
}
142+
},
143+
"resources": [
144+
{
145+
"name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
146+
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
147+
"apiVersion": "2020-03-01",
148+
"location": "[parameters('location')]",
149+
"properties": {
150+
"privateDnsZoneConfigs": [
151+
{
152+
"name": "storageBlob-privateDnsZone",
153+
"properties": {
154+
"privateDnsZoneId": "[parameters('privateDnsZoneId')]"
155+
}
156+
}
157+
]
158+
}
159+
}
160+
]
161+
},
162+
"parameters": {
163+
"privateDnsZoneId": {
164+
"value": "[parameters('privateDnsZoneId')]"
165+
},
166+
"privateEndpointName": {
167+
"value": "[field('name')]"
168+
},
169+
"location": {
170+
"value": "[field('location')]"
171+
}
172+
}
173+
}
174+
}
175+
}
176+
}
177+
},
178+
"parameters": {
179+
"privateDnsZoneId": {
180+
"type": "String",
181+
"metadata": {
182+
"displayName": "privateDnsZoneId",
183+
"description": null,
184+
"strongType": "Microsoft.Network/privateDnsZones"
185+
}
186+
}
187+
}
188+
}
189+
```
190+
191+
### Policy assignment
192+
193+
After you deploy the policy definition, assign the policy at the subscription hosting the Azure Spring Apps service instances and specify the central private DNS zone as the parameter.
194+
195+
The central private DNS zone and Azure Spring Apps service instance might be hosted in the different subscriptions. In this case, remember to assign the [Private DNS Zone Contributor role](/azure/dns/dns-protect-private-zones-recordsets) in the subscription and resource group where the private DNS zones are hosted to the managed identity created by the `DeployIfNotExists` policy assignment that's responsible to create and manage the private endpoint DNS record in the private DNS zone. For more information, see the [Configure the managed identity](../../governance/policy/how-to/remediate-resources.md?tabs=azure-portal#configure-the-managed-identity) section of [Remediate non-compliant resources with Azure Policy](../../governance/policy/how-to/remediate-resources.md?tabs=azure-portal).
196+
197+
After you finish the configurations, when you enable or disable the private storage access feature, the DNS records for private endpoints are automatically registered - and removed after a private endpoint is deleted - in the corresponding private DNS zone.
198+
75199
## Extra costs
76200

77201
The Azure Spring Apps instance doesn't incur charges for this feature. However, you're billed for the private link resources hosted in your subscription that support this feature. For more information, see [Azure Private Link Pricing](https://azure.microsoft.com/pricing/details/private-link/) and [Azure DNS Pricing](https://azure.microsoft.com/pricing/details/dns/).
@@ -80,6 +204,7 @@ The Azure Spring Apps instance doesn't incur charges for this feature. However,
80204

81205
If you're using a custom domain name system (DNS) server and the Azure DNS IP `168.63.129.16` isn't configured as the upstream DNS server, you must manually bind all the DNS records of the private DNS zones shown in the resource group `ap-res_{service instance name}_{service instance region}` to resolve the private IP addresses.
82206

83-
## Next step
207+
## Next steps
84208

85-
[Customer responsibilities for running Azure Spring Apps in a virtual network](vnet-customer-responsibilities.md)
209+
* [Customer responsibilities for running Azure Spring Apps in a virtual network](vnet-customer-responsibilities.md)
210+
* [Private Link and DNS integration at scale](/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale)

0 commit comments

Comments
 (0)