Azure Network Private Link Service
This page shows how to write Terraform and Azure Resource Manager for Network Private Link Service and write them securely.
azurerm_private_link_service (Terraform)
The Private Link Service in Network can be configured in Terraform with the resource name azurerm_private_link_service
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_private_link_service" "mktp-fin-prod-mongodb" {
name = "mktp-fin-prod-mongodb"
resource_group_name = azurerm_resource_group.Financial-prod-vnet-enpoint.name
location = var.BRS
auto_approval_subscription_ids = ["4220b454-81b6-4e1a-8f57-4bb445ff0992"]
resource "azurerm_private_link_service" "pls" {
name = var.pls_name
resource_group_name = var.rg.name
location = var.rg.location
enable_proxy_protocol = true
resource "azurerm_private_link_service" "pls" {
count = var.enable_pls ? 1 : 0
name = var.pls_name
resource_group_name = var.resource_group_name
location = var.location
auto_approval_subscription_ids = var.auto_approval_subscription_ids
resource "azurerm_private_link_service" "wowza" {
name = var.service_name
resource_group_name = azurerm_resource_group.wowza.name
location = azurerm_resource_group.wowza.location
resource "azurerm_private_link_service" "pls" {
name = "Web-pls"
resource_group_name = azurerm_resource_group.plspenat.name
location = azurerm_resource_group.plspenat.location
auto_approval_subscription_ids = [data.azurerm_subscription.this.subscription_id]
resource "azurerm_private_link_service" "demo" {
name = var.private_link_name
resource_group_name = var.rg_name
location = var.location
#auto_approval_subscription_ids = ["00000000-0000-0000-0000-000000000000"]
resource "azurerm_private_link_service" "test" {
name = "acctestpls"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
nat_ip_configuration {
resource "azurerm_private_link_service" "example" {
name = "example-privatelink"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
nat_ip_configuration {
resource "azurerm_private_link_service" "example" {
name = "example-privatelink"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
nat_ip_configuration {
resource "azurerm_private_link_service" "test" {
name = "acctestpls"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
nat_ip_configuration {
Parameters
-
alias
optional computed - string -
auto_approval_subscription_ids
optional - set of string -
enable_proxy_protocol
optional - bool -
id
optional computed - string -
load_balancer_frontend_ip_configuration_ids
required - set of string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
visibility_subscription_ids
optional - set of string -
nat_ip_configuration
list block-
name
required - string -
primary
required - bool -
private_ip_address
optional - string -
private_ip_address_version
optional - string -
subnet_id
required - string
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Private Link Service. -> NOTE Private Link is now in GA.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/privateLinkServices (Azure Resource Manager)
The privateLinkServices in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/privateLinkServices
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/privateLinkServices",
"apiVersion": "2020-05-01",
"location": "[resourceGroup().location]",
"name": "[concat(parameters('resourceNamePrefix'), 'private-link-', parameters('priveteLinkType'))]",
"properties": {
"autoApproval": {
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
"type": "Microsoft.Network/privateLinkServices",
"location": "eastus",
"properties": {
"provisioningState": "Succeeded",
"visibility": {
"subscriptions": [
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
extendedLocation
optionalname
required - stringThe name of the extended location.
type
required - stringThe type of the extended location.
properties
requiredloadBalancerFrontendIpConfigurations
optional arrayid
required - stringResource ID.
ipConfigurations
optional arrayproperties
optionalprivateIPAddress
optional - stringThe private IP address of the IP configuration.
privateIPAllocationMethod
optional - stringThe private IP address allocation method.
subnet
optionalid
required - stringResource ID.
primary
optional - booleanWhether the ip configuration is primary or not.
privateIPAddressVersion
optional - stringWhether the specific IP configuration is IPv4 or IPv6. Default is IPv4.
name
optional - stringThe name of private link service ip configuration.
visibility
optionalsubscriptions
optional - arrayThe list of subscriptions.
autoApproval
optionalsubscriptions
optional - arrayThe list of subscriptions.
fqdns
optional - arrayThe list of Fqdn.
enableProxyProtocol
optional - booleanWhether the private link service is enabled for proxy protocol or not.
Frequently asked questions
What is Azure Network Private Link Service?
Azure Network Private Link Service is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Private Link Service?
For Terraform, the AvocadoDevOps/azure-marketplace-prod-terraform, yz4898/att_mvm and dhileepbalaji/azure source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the mhenderson442/mercury-arm, debhol/azuredocs and debhol/azuredocs source code examples are useful. See the Azure Resource Manager Example section for further details.