Azure Private Link
Author: Ronald Fung
Creation Date: 30 May 2023
Next Modified Date: 30 May 2024
A. Introduction
Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.
Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no longer necessary. You can create your own private link service in your virtual network and deliver it to your customers. Setup and consumption using Azure Private Link is consistent across Azure PaaS, customer-owned, and shared partner services.
[!IMPORTANT] Azure Private Link is now generally available. Both Private Endpoint and Private Link service (service behind standard load balancer) are generally available. Different Azure PaaS will onboard to Azure Private Link at different schedules. See Private Link availability for an accurate status of Azure PaaS on Private Link. For known limitations, see Private Endpoint and Private Link Service.
:::image type=”content” source=”./media/private-link-overview/private-link-center.png” alt-text=”Screenshot of Azure Private Link center in Azure portal.” :::
Key benefits
Azure Private Link provides the following benefits:
Privately access services on the Azure platform: Connect your virtual network using private endpoints to all services that can be used as application components in Azure. Service providers can render their services in their own virtual network and consumers can access those services in their local virtual network. The Private Link platform will handle the connectivity between the consumer and services over the Azure backbone network.
On-premises and peered networks: Access services running in Azure from on-premises over ExpressRoute private peering, VPN tunnels, and peered virtual networks using private endpoints. There’s no need to configure ExpressRoute Microsoft peering or traverse the internet to reach the service. Private Link provides a secure way to migrate workloads to Azure.
Protection against data leakage: A private endpoint is mapped to an instance of a PaaS resource instead of the entire service. Consumers can only connect to the specific resource. Access to any other resource in the service is blocked. This mechanism provides protection against data leakage risks.
Global reach: Connect privately to services running in other regions. The consumer’s virtual network could be in region A and it can connect to services behind Private Link in region B.
Extend to your own services: Enable the same experience and functionality to render your service privately to consumers in Azure. By placing your service behind a standard Azure Load Balancer, you can enable it for Private Link. The consumer can then connect directly to your service using a private endpoint in their own virtual network. You can manage the connection requests using an approval call flow. Azure Private Link works for consumers and services belonging to different Azure Active Directory tenants.
[!NOTE] Azure Private Link, along with Azure Virtual Network, span across Azure Availability Zones and are therefore zone resilient. To provide high availability for the Azure resource using a private endpoint, ensure that resource is zone resilient.
B. How is it used at Seagen
As a biopharma research company using Microsoft Azure, Seagen could use Azure Private Link to securely access Azure services over a private endpoint within the virtual network. Here are some ways Seagen could use Azure Private Link:
Securely access Azure services: Azure Private Link allows Seagen to securely access Azure services, such as Azure Storage, Azure SQL Database, or Azure Cosmos DB, over a private endpoint within the virtual network. This ensures that data is not exposed to the public internet and that traffic is secured using private IP addresses.
Enforce network security: Azure Private Link allows Seagen to enforce network security by controlling access to Azure services. Seagen can use network security groups to restrict access to Azure services to only specific virtual networks or subnets.
Simplify networking: Azure Private Link simplifies networking by eliminating the need for public IP addresses or VPN connections. Seagen can use private IP addresses to securely access Azure services over the virtual network.
Improve performance: Azure Private Link improves the performance of accessing Azure services by reducing latency and improving throughput. Seagen can access Azure services over the virtual network with better performance than over the public internet.
Compliance and governance: Azure Private Link supports compliance and governance requirements by providing a secure and private connection to Azure services. Seagen can enforce compliance policies and audit access to Azure services over the virtual network.
Overall, Azure Private Link provides a secure and private way for Seagen to access Azure services over the virtual network. Its ability to enforce network security, simplify networking, improve performance, and support compliance and governance requirements makes it a valuable tool for organizations, such as Seagen, that require secure and private access to Azure services for their enterprise applications and workloads.
C. Features
Azure Private Link is a service that allows users to access Azure services over a private endpoint within a virtual network. Some of the key features of Azure Private Link include:
Private endpoint: Azure Private Link provides a private endpoint for accessing Azure services over the virtual network. This ensures that traffic remains within the virtual network and is not exposed to the public internet.
Network security: Azure Private Link allows users to enforce network security by controlling access to Azure services. Users can use network security groups to restrict access to Azure services to only specific virtual networks or subnets.
Simplified networking: Azure Private Link simplifies networking by eliminating the need for public IP addresses or VPN connections. Users can use private IP addresses to securely access Azure services over the virtual network.
Improved performance: Azure Private Link improves the performance of accessing Azure services by reducing latency and improving throughput. Users can access Azure services over the virtual network with better performance than over the public internet.
Compliance and governance: Azure Private Link supports compliance and governance requirements by providing a secure and private connection to Azure services. Users can enforce compliance policies and audit access to Azure services over the virtual network.
Integration with Azure services: Azure Private Link is integrated with other Azure services, such as Azure Storage, Azure SQL Database, or Azure Cosmos DB, which can enhance the security and performance of accessing Azure services.
Multi-cloud support: Azure Private Link supports multi-cloud scenarios by allowing users to connect to Azure services across multiple clouds using private endpoints.
Overall, Azure Private Link provides a powerful tool for accessing Azure services over a private endpoint within the virtual network. Its ability to provide network security, simplify networking, improve performance, support compliance and governance requirements, integrate with Azure services, and support multi-cloud scenarios makes it a valuable tool for organizations that require secure and private access to Azure services for their enterprise applications and workloads.
D. Where Implemented
E. How it is tested
Testing Azure Private Link involves several steps that include:
Creating a test environment: The first step is to create a test environment that is separate from the production environment. This ensures that any issues or bugs discovered during testing do not affect the live system.
Configuring Azure Private Link: The next step is to configure Azure Private Link for the Azure services that need to be accessed over the private endpoint. This involves creating private endpoints, setting up network security groups, and configuring routing rules.
Testing connectivity: Once Azure Private Link is configured, the next step is to test connectivity. This involves verifying that the Azure services can be accessed over the private endpoint and that traffic is not exposed to the public internet.
Testing network security: After testing connectivity, the next step is to test network security. This involves verifying that network security groups are properly configured to restrict access to Azure services to only specific virtual networks or subnets.
Testing compliance: Once network security is tested, the next step is to test compliance. This involves verifying that Azure Private Link supports compliance and governance requirements by providing a secure and private connection to Azure services.
Integration testing: After Azure Private Link has been tested, it must be integrated with other systems and applications to ensure that it works seamlessly with other components.
User acceptance testing: Finally, Azure Private Link must undergo user acceptance testing to ensure that it meets the requirements of the end-users.
Overall, testing Azure Private Link involves a comprehensive testing approach that covers all the functionalities of the solution and ensures that it meets the requirements of the end-users. Testing should include both functional and non-functional testing, such as performance testing, security testing, and scalability testing. It is also important to test the integration of Azure Private Link with other systems and applications to ensure that it works seamlessly with other components. It is recommended to test Azure Private Link in a test environment before deploying it in a production environment to minimize the risk of issues during production use.
F. 2023 Roadmap
????
G. 2024 Roadmap
????
H. Known Issues
Like all software products, Azure Private Link may have some known issues. Here are some of the known issues of Azure Private Link:
Private endpoint creation issues: Azure Private Link may have issues with creating private endpoints, such as private endpoints not being created correctly or private endpoints not working as expected.
Network security issues: Azure Private Link may have issues with network security, such as network security groups not being configured correctly or network security groups not working as expected.
Connectivity issues: Azure Private Link may have issues with connectivity, such as Azure services not being accessible over the private endpoint or traffic being exposed to the public internet.
Performance issues: Azure Private Link may have performance issues, such as increased latency or reduced throughput when accessing Azure services over the private endpoint.
Integration issues: Azure Private Link may have integration issues when integrating with other Azure services or third-party applications, which can impact the ability of organizations to use Azure Private Link for their enterprise applications and workloads.
Overall, while Azure Private Link is a powerful solution for accessing Azure services over a private endpoint within the virtual network, users must be aware of these known issues and take steps to mitigate their impact. This may include addressing private endpoint creation issues, ensuring correct network security group configurations, monitoring connectivity and performance, and ensuring compatibility and integration with other systems and applications. It is also important to carefully plan and test the use of Azure Private Link to minimize the risk of issues during production use.
[x] Reviewed by Enterprise Architecture
[x] Reviewed by Application Development
[x] Reviewed by Data Architecture