Skip to content

Commit b151d8b

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #96224 from SnehaGunda/PrivateLink1
Adding PrivateZones ARM template code
2 parents e49a679 + 76b858d commit b151d8b

File tree

1 file changed

+198
-3
lines changed

1 file changed

+198
-3
lines changed

‎articles/cosmos-db/how-to-configure-private-endpoints.md

Lines changed: 198 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ foreach ($IPConfiguration in $networkInterface.IpConfigurations)
180180

181181
## Create a private endpoint by using a Resource Manager template
182182

183-
You can set up Private Link by creating a private endpoint in a virtual network subnet. You achieve this by using an Azure Resource Manager template.
183+
You can set up Private Link by creating a private endpoint in a virtual network subnet. You achieve this by using an Azure Resource Manager template.
184184

185185
Use the following code to create a Resource Manager template named "PrivateEndpoint_template.json." This template creates a private endpoint for an existing Azure Cosmos SQL API account in an existing virtual network.
186186

@@ -241,7 +241,7 @@ Use the following code to create a Resource Manager template named "PrivateEndpo
241241
}
242242
```
243243

244-
### Define the parameters file for the template
244+
**Define the parameters file for the template**
245245

246246
Create a parameters file for the template, and name it "PrivateEndpoint_parameters.json." Add the following code to the parameters file:
247247

@@ -266,7 +266,7 @@ Create a parameters file for the template, and name it "PrivateEndpoint_paramete
266266
}
267267
```
268268

269-
### Deploy the template by using a PowerShell script
269+
**Deploy the template by using a PowerShell script**
270270

271271
Create a PowerShell script by using the following code. Before you run the script, replace the subscription ID, resource group name, and other variable values with the details for your environment.
272272

@@ -330,6 +330,201 @@ After the template is deployed successfully, you can see an output similar to wh
330330

331331
After the template is deployed, the private IP addresses are reserved within the subnet. The firewall rule of the Azure Cosmos account is configured to accept connections from the private endpoint only.
332332

333+
### Integrate the private endpoint with a Private DNS Zone
334+
335+
Use the following code to create a Resource Manager template named "PrivateZone_template.json." This template creates a private DNS zone for an existing Azure Cosmos SQL API account in an existing virtual network.
336+
337+
```json
338+
{
339+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
340+
"contentVersion": "1.0.0.0",
341+
"parameters": {
342+
"privateZoneName": {
343+
"type": "string"
344+
},
345+
"VNetId": {
346+
"type": "string"
347+
}
348+
},
349+
"resources": [
350+
{
351+
"name": "[parameters('privateZoneName')]",
352+
"type": "Microsoft.Network/privateDnsZones",
353+
"apiVersion": "2018-09-01",
354+
"location": "global",
355+
"properties": {
356+
}
357+
},
358+
{
359+
"type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
360+
"apiVersion": "2018-09-01",
361+
"name": "[concat(parameters('privateZoneName'), '/myvnetlink')]",
362+
"location": "global",
363+
"dependsOn": [
364+
"[resourceId('Microsoft.Network/privateDnsZones', parameters('privateZoneName'))]"
365+
],
366+
"properties": {
367+
"registrationEnabled": false,
368+
"virtualNetwork": {
369+
"id": "[parameters('VNetId')]"
370+
}
371+
}
372+
}
373+
]
374+
}
375+
```
376+
377+
Use the following code to create a Resource Manager template named "PrivateZoneRecords_template.json."
378+
379+
```json
380+
{
381+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
382+
"contentVersion": "1.0.0.0",
383+
"parameters": {
384+
"DNSRecordName": {
385+
"type": "string"
386+
},
387+
"IPAddress": {
388+
"type":"string"
389+
}
390+
},
391+
"resources": [
392+
{
393+
"type": "Microsoft.Network/privateDnsZones/A",
394+
"apiVersion": "2018-09-01",
395+
"name": "[parameters('DNSRecordName')]",
396+
"properties": {
397+
"ttl": 300,
398+
"aRecords": [
399+
{
400+
"ipv4Address": "[parameters('IPAddress')]"
401+
}
402+
]
403+
}
404+
}
405+
]
406+
}
407+
```
408+
409+
**Define the parameters file for the template**
410+
411+
Create the following two parameters file for the template. Create the "PrivateZone_parameters.json." with the following code:
412+
413+
```json
414+
{
415+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
416+
"contentVersion": "1.0.0.0",
417+
"parameters": {
418+
"privateZoneName": {
419+
"value": ""
420+
},
421+
"VNetId": {
422+
"value": ""
423+
}
424+
}
425+
}
426+
```
427+
428+
Create the "PrivateZoneRecords_parameters.json." with the following code:
429+
430+
```json
431+
{
432+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
433+
"contentVersion": "1.0.0.0",
434+
"parameters": {
435+
"DNSRecordName": {
436+
"value": ""
437+
},
438+
"IPAddress": {
439+
"type":"object"
440+
}
441+
}
442+
}
443+
```
444+
445+
**Deploy the template by using a PowerShell script**
446+
447+
Create a PowerShell script by using the following code. Before you run the script, replace the subscription ID, resource group name, and other variable values with the details for your environment.
448+
449+
```azurepowershell-interactive
450+
### This script:
451+
### - creates a private zone
452+
### - creates a private endpoint for an existing Cosmos DB account in an existing VNet
453+
### - maps the private endpoint to the private zone
454+
455+
## Step 1: Fill in these details. Replace the variable values with the details for your environment.
456+
$SubscriptionId = "<your Azure subscription ID>"
457+
# Resource group where the Azure Cosmos account and virtual network resources are located
458+
$ResourceGroupName = "myResourceGroup"
459+
# Name of the Azure Cosmos account
460+
$CosmosDbAccountName = "mycosmosaccount"
461+
# API type of the Azure Cosmos account. It can be one of the following: "Sql", "MongoDB", "Cassandra", "Gremlin", "Table"
462+
$CosmosDbApiType = "Sql"
463+
# Name of the existing virtual network
464+
$VNetName = "myVnet"
465+
# Name of the target subnet in the virtual network
466+
$SubnetName = "mySubnet"
467+
# Name of the private zone to create
468+
$PrivateZoneName = "myPrivateZone.documents.azure.com"
469+
# Name of the private endpoint to create
470+
$PrivateEndpointName = "myPrivateEndpoint"
471+
472+
$cosmosDbResourceId = "/subscriptions/$($SubscriptionId)/resourceGroups/$($ResourceGroupName)/providers/Microsoft.DocumentDB/databaseAccounts/$($CosmosDbAccountName)"
473+
$VNetResourceId = "/subscriptions/$($SubscriptionId)/resourceGroups/$($ResourceGroupName)/providers/Microsoft.Network/virtualNetworks/$($VNetName)"
474+
$SubnetResourceId = "$($VNetResourceId)/subnets/$($SubnetName)"
475+
$PrivateZoneTemplateFilePath = "PrivateZone_template.json"
476+
$PrivateZoneParametersFilePath = "PrivateZone_parameters.json"
477+
$PrivateZoneRecordsTemplateFilePath = "PrivateZoneRecords_template.json"
478+
$PrivateZoneRecordsParametersFilePath = "PrivateZoneRecords_parameters.json"
479+
$PrivateEndpointTemplateFilePath = "PrivateEndpoint_template.json"
480+
$PrivateEndpointParametersFilePath = "PrivateEndpoint_parameters.json"
481+
482+
## Step 2: Login your Azure account and select the target subscription
483+
Login-AzAccount
484+
Select-AzSubscription -SubscriptionId $subscriptionId
485+
486+
## Step 3: Make sure private endpoint network policies are disabled in the subnet
487+
$VirtualNetwork= Get-AzVirtualNetwork -Name "$VNetName" -ResourceGroupName "$ResourceGroupName"
488+
($virtualNetwork | Select -ExpandProperty subnets | Where-Object {$_.Name -eq "$SubnetName"} ).PrivateEndpointNetworkPolicies = "Disabled"
489+
$virtualNetwork | Set-AzVirtualNetwork
490+
491+
## Step 4: Create the private zone
492+
New-AzResourceGroupDeployment -Name "PrivateZoneDeployment" `
493+
-ResourceGroupName $ResourceGroupName `
494+
-TemplateFile $PrivateZoneTemplateFilePath `
495+
-TemplateParameterFile $PrivateZoneParametersFilePath `
496+
-PrivateZoneName $PrivateZoneName `
497+
-VNetId $VNetResourceId
498+
499+
## Step 5: Create the private endpoint
500+
Write-Output "Deploying private endpoint on $($resourceGroupName)"
501+
$deploymentOutput = New-AzResourceGroupDeployment -Name "PrivateCosmosDbEndpointDeployment" `
502+
-ResourceGroupName $resourceGroupName `
503+
-TemplateFile $PrivateEndpointTemplateFilePath `
504+
-TemplateParameterFile $PrivateEndpointParametersFilePath `
505+
-SubnetId $SubnetResourceId `
506+
-ResourceId $CosmosDbResourceId `
507+
-GroupId $CosmosDbApiType `
508+
-PrivateEndpointName $PrivateEndpointName
509+
$deploymentOutput
510+
511+
## Step 6: Map the private endpoint to the private zone
512+
$networkInterface = Get-AzResource -ResourceId $deploymentOutput.Outputs.privateEndpointNetworkInterface.Value -ApiVersion "2019-04-01"
513+
foreach ($ipconfig in $networkInterface.properties.ipConfigurations) {
514+
foreach ($fqdn in $ipconfig.properties.privateLinkConnectionProperties.fqdns) {
515+
$recordName = $fqdn.split('.',2)[0]
516+
$dnsZone = $fqdn.split('.',2)[1]
517+
Write-Output "Deploying PrivateEndpoint DNS Record $($PrivateZoneName)/$($recordName) Template on $($resourceGroupName)"
518+
New-AzResourceGroupDeployment -Name "PrivateEndpointDNSDeployment" `
519+
-ResourceGroupName $ResourceGroupName `
520+
-TemplateFile $PrivateZoneRecordsTemplateFilePath `
521+
-TemplateParameterFile $PrivateZoneRecordsParametersFilePath `
522+
-DNSRecordName "$($PrivateZoneName)/$($RecordName)" `
523+
-IPAddress $ipconfig.properties.privateIPAddress
524+
}
525+
}
526+
```
527+
333528
## Configure custom DNS
334529

335530
You should use a private DNS zone within the subnet where you've created the private endpoint. Configure the endpoints so that each private IP address is mapped to a DNS entry. (See the `fqdns` property in the response shown earlier.)

0 commit comments

Comments
 (0)