You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Manage virtual networks - Azure portal with Private Link- Azure Database for PostgreSQL - Flexible Server
3
-
description: Create and manage virtual networks for Azure Database with Private Link for PostgreSQL - Flexible Server using the Azure portal
2
+
title: Manage virtual networks - Azure portal with Private Link- Azure Database for PostgreSQL - Flexible Server
3
+
description: Learn how to create a PostgreSQL server with public access by using the Azure portal, and how to add private networking to the server based on Azure Private Link.
4
4
author: gennadNY
5
5
ms.author: gennadyk
6
6
ms.service: postgresql
@@ -12,86 +12,107 @@ ms.date: 10/23/2023
12
12
---
13
13
14
14
15
-
# Create and manage virtual networks with Private Link for Azure Database for PostgreSQL - Flexible Server using the Azure portal
15
+
# Create and manage virtual networks with Private Link for Azure Database for PostgreSQL - Flexible Server by using the Azure portal
Azure Database for PostgreSQL - Flexible Server supports two types of mutually exclusive network connectivity methods to connect to your flexible server. The two options are:
19
+
Azure Database for PostgreSQL - Flexible Server supports two types of mutually exclusive network connectivity methods to connect to your flexible server:
20
20
21
-
* Public access (allowed IP addresses). That method can be further secured by using [Private Link](./concepts-networking-private-link.md)based networking with Azure Database for PostgreSQL - Flexible Serverin Preview.
22
-
* Private access (VNet Integration)
21
+
* Public access through allowed IP addresses. You can further secure that method by using [Azure Private Link](./concepts-networking-private-link.md)-based networking with Azure Database for PostgreSQL - Flexible Server. The feature is in preview.
22
+
* Private access through virtual network integration.
23
23
24
-
In this article, we'll focus on creation of PostgreSQL server with **Public access (allowed IP addresses)**using Azure portal and securing it **adding private networking to the server based on [Private Link](./concepts-networking-private-link.md) technology**. **[Azure Private Link](../../private-link/private-link-overview.md)** enables you to access Azure PaaS Services, such as [Azure Database for PostgreSQL - Flexible Server](./concepts-networking-private-link.md) , and Azure hosted customer-owned/partner services over a **Private Endpoint** in your virtual network. **Traffic between your virtual network and the service traverses over the Microsoft backbone network, eliminating exposure from the public Internet**.
24
+
This article focuses on creation of a PostgreSQL server with public access (allowed IP addresses) by the using Azure portal. You can then help secure the server by adding private networking based on Private Link technology.
25
25
26
-
> [!NOTE]
27
-
> Azure Database for PostgreSQL - Flexible Server supports Private Link based networking in Preview.
26
+
You can use [Private Link](../../private-link/private-link-overview.md) to access the following services over a private endpoint in your virtual network:
27
+
28
+
* Azure platform as a service (PaaS) services, such as Azure Database for PostgreSQL - Flexible Server
29
+
* Customer-owned or partner services that are hosted in Azure
30
+
31
+
Traffic between your virtual network and a service traverses the Microsoft backbone network, which eliminates exposure to the public internet.
28
32
29
33
## Prerequisites
30
34
31
-
To add a flexible server to the virtual network using Private Link, you need:
32
-
- A [Virtual Network](../../virtual-network/quick-create-portal.md#create-a-virtual-network). The virtual network and subnet should be in the same region and subscription as your flexible server. The virtual network shouldn't have any resource lock set at the virtual network or subnet level, as locks might interfere with operations on the network and DNS. Make sure to remove any lock (**Delete** or **Read only**) from your virtual network and all subnets before adding server to a virtual network, and you can set it back after server creation.
33
-
- Register [**PostgreSQL Private Endpoint capability** preview feature in your subscription](../../azure-resource-manager/management/preview-features.md).
35
+
To add a flexible server to a virtual network by using Private Link, you need:
36
+
37
+
* A [virtual network](../../virtual-network/quick-create-portal.md#create-a-virtual-network). The virtual network and subnet should be in the same region and subscription as your flexible server.
34
38
35
-
## Create an Azure Database for PostgreSQL - Flexible Server with Private Endpoint
39
+
Be sure to remove any locks (**Delete** or **Read only**) from your virtual network and all subnets before you add a server to the virtual network, because locks might interfere with operations on the network and DNS. You can reset the locks after server creation.
40
+
* Registration of the [PostgreSQL private endpoint preview feature in your subscription](../../azure-resource-manager/management/preview-features.md).
41
+
42
+
## Create an Azure Database for PostgreSQL - Flexible Server instance with a private endpoint
36
43
37
44
To create an Azure Database for PostgreSQL server, take the following steps:
38
45
39
-
1.Select Create a resource **(+)** in the upper-left corner of the portal.
46
+
1.In the upper-left corner of the Azure portal, select **Create a resource** (the plus sign).
40
47
41
-
2. Select **Databases > Azure Database for PostgreSQL**.
48
+
2. Select **Databases** > **Azure Database for PostgreSQL**.
42
49
43
50
3. Select the **Flexible server** deployment option.
44
51
45
-
4. Fill out the Basics form with the pertinent information. tHis includes Azure subscription, resource group, Azure region location, server name, server administrative credentials.
46
-
47
-
|**Setting**|**Value**|
48
-
|---------|------|
49
-
|Subscription| Select your **Azure subscription**|
50
-
|Resource group| Select your **Azure resource group**|
51
-
|Server name| Enter **unique server name**|
52
-
|Admin username |Enter an **administrator name** of your choosing|
53
-
|Password|Enter a **password** of your choosing. The password must be at least eight characters long and meet the defined requirements|
54
-
|Location|Select an **Azure region** where you want to want your PostgreSQL Server to reside, example West Europe|
55
-
|Version|Select the **database version** of the PostgreSQL server that is required|
56
-
|Compute + Storage|Select the **pricing tier** that is needed for the server based on the workload|
57
-
58
-
5. Select **Next:Networking**
59
-
6. Choose **"Public access (allowed IP addresses) and Private endpoint"** checkbox checked as Connectivity method.
60
-
7. Select **"Add Private Endpoint"** in Private Endpoint section
61
-
:::image type="content" source="./media/how-to-manage-virtual-network-private-endpoint-portal/private-endpoint-selection.png" alt-text="Screenshot of Add Private Endpoint button in Private Endpoint Section in Networking blade of Azure Portal" :::
62
-
8. In Create Private Endpoint Screen enter following:
63
-
64
-
|**Setting**|**Value**|
65
-
|---------|------|
66
-
|Subscription| Select your **subscription**|
67
-
|Resource group| Select **resource group** you picked previously|
68
-
|Location|Select an **Azure region where you created your VNET**, example West Europe|
69
-
|Name|Name of Private Endpoint|
70
-
|Target subresource|**postgresqlServer**|
71
-
|NETWORKING|
72
-
|Virtual Network| Enter **VNET name** for Azure virtual network created previously |
73
-
|Subnet|Enter **Subnet name** for Azure Subnet you created previously|
74
-
|PRIVATE DNS INTEGRATION]
75
-
|Integrate with Private DNS Zone|**Yes**|
76
-
|Private DNS Zone| Pick **(New)privatelink.postgresql.database.azure.com**. This creates new private DNS zone.|
52
+
4. Fill out the **Basics** form with the following information:
53
+
54
+
|Setting |Value|
55
+
|---------|------|
56
+
|**Subscription**| Select your Azure subscription.|
57
+
|**Resource group**| Select your Azure resource group.|
58
+
|**Server name**| Enter a unique server name.|
59
+
|**Admin username**|Enter an administrator name of your choosing.|
60
+
|**Password**|Enter a password of your choosing. The password must have at least eight characters and meet the defined requirements.|
61
+
|**Location**|Select an Azure region where you want to want your PostgreSQL server to reside.|
62
+
|**Version**|Select the required database version of the PostgreSQL server.|
63
+
|**Compute + Storage**|Select the pricing tier that you need for the server, based on the workload.|
64
+
65
+
5. Select **Next: Networking**.
66
+
67
+
6. For **Connectivity method**, select the **Public access (allowed IP addresses) and private endpoint** checkbox.
68
+
69
+
7. In the **Private Endpoint (preview)** section, select **Add private endpoint**.
70
+
71
+
:::image type="content" source="./media/how-to-manage-virtual-network-private-endpoint-portal/private-endpoint-selection.png" alt-text="Screenshot of the button for adding a private endpoint button on the Networking pane in the Azure portal." :::
72
+
8. On the **Create Private Endpoint** pane, enter the following values:
73
+
74
+
|Setting|Value|
75
+
|---------|------|
76
+
|**Subscription**| Select your subscription.|
77
+
|**Resource group**| Select the resource group that you chose previously.|
78
+
|**Location**|Select an Azure region where you created your virtual network.|
|**Virtual Network**| Enter a name for the Azure virtual network that you created previously. |
83
+
|**Subnet**|Enter the name of the Azure subnet that you created previously.|
84
+
|**PRIVATE DNS INTEGRATION**|
85
+
|**Integrate with Private DNS Zone**| Select **Yes**.|
86
+
|**Private DNS Zone**| Select **(New)privatelink.postgresql.database.azure.com**. This setting creates a new private DNS zone.|
77
87
78
88
9. Select **OK**.
79
-
10. Select **Review + create**. You're taken to the **Review + create** page where Azure validates your configuration.
80
-
11. Networking section of the **Review + Create** page will list your Private Endpoint information.
81
-
12. When you see the Validation passed message, select **Create**.
82
-
83
-
### Approval Process for Private Endpoint
84
-
85
-
With separation of duties, common in many enterprises today, creation of cloud networking infrastructure, such as Azure Private Link services, are done by network administrator, whereas database servers are commonly created and managed by database administrator (DBA).
86
-
Once the network administrator creates the private endpoint (PE), the PostgreSQL database administrator (DBA) can manage the **Private Endpoint Connection (PEC)** to Azure Database for PostgreSQL.
87
-
1. Navigate to the Azure Database for PostgreSQL - Flexible Server resource in the Azure portal.
88
-
- Select **Networking** in the left pane.
89
-
- Shows a list of all **Private Endpoint Connections (PECs)**.
- Select an individual **PEC** from the list by selecting it.
92
-
- The PostgreSQL server admin can choose to **approve** or **reject a PEC** and optionally add a short text response.
93
-
- After approval or rejection, the list will reflect the appropriate state along with the response text.
89
+
90
+
10. Select **Review + create**.
91
+
92
+
11. On the **Review + create** tab, Azure validates your configuration. The **Networking** section lists information about your private endpoint.
93
+
94
+
When you see the message that your configuration passed validation, select **Create**.
95
+
96
+
### Approval process for a private endpoint
97
+
98
+
A separation of duties is common in many enterprises today:
99
+
100
+
* A network administrator creates the cloud networking infrastructure, such as Azure Private Link services.
101
+
* A database administrator (DBA) creates and manages database servers.
102
+
103
+
After a network administrator creates a private endpoint, the PostgreSQL DBA can manage the private endpoint connection to Azure Database for PostgreSQL. The DBA uses the following approval process for a private endpoint connection:
104
+
105
+
1. In the Azure portal, go to the Azure Database for PostgreSQL - Flexible Server resource.
106
+
107
+
1. On the left pane, select **Networking**.
108
+
109
+
1. A list of all private endpoint connections appears, along with corresponding private endpoints. Select a private endpoint connection from the list.
110
+
111
+
1. Select **Approve** or **Reject**, and optionally add a short text response.
112
+
113
+
After approval or rejection, the list reflects the appropriate state, along with the response text.
94
114
95
115
## Next steps
96
-
- Learn more about [networking in Azure Database for PostgreSQL - Flexible Server using Private Link](./concepts-networking-private-link.md).
97
-
- Understand more about [Azure Database for PostgreSQL - Flexible Server virtual network using VNET Integration](./concepts-networking-private.md).
116
+
117
+
* Learn more about [networking in Azure Database for PostgreSQL - Flexible Server with Private Link](./concepts-networking-private-link.md).
118
+
* Understand more about [virtual network integration in Azure Database for PostgreSQL - Flexible Server](./concepts-networking-private.md).
0 commit comments