A11 - Azure networking and private endpoints

• Azure services can expose public endpoints, meaning the service has an address reachable through its public network interface, subject to its security controls
• an Azure Virtual Network (VNet) is a logically isolated network in Azure that provides private IP address spaceand networking boundaries for resources

Azure
└── VNet: research-prod
     ├── subnet A
     ├── subnet B
     └── subnet C

• a VNet can be divided into subnets
• resources/network interfaces can be associated with them according to Azure service requirements

10.0.0.0/16        VNet
├── 10.0.1.0/24    compute subnet
├── 10.0.2.0/24    private endpoints
└── 10.0.3.0/24    application subnet

• a public endpoint exposes Azure services through its public service endpoint

• authentication/RBAC can still protect it, but both identity and network security are needed

• a private endpoint gives a supported Azure service a private network interface/private IP in the VNet for accessing that service privately

		        VNet
                 │
	┌─────────┴─────────┐
	│                                                       │
    workload                             Private Endpoint
                            │
	                      private IP
                            │
                            ▼
                      Azure Storage

• a private link is the underlying private-connectivity technology/service

• a private endpoint is the network interface/private IP created in the VNet

• an AML workspace references other Azure resources

• making only the workspace private does not magically make every dependency private

• a secured architecture may therefore require private connectivity/network configuration for dependent resources too

                   PRIVATE NETWORK
                           │
	┌────────────────┼─────────────────┐
	▼                                                ▼                                                  ▼
AML workspace                         Storage                                   Key Vault
	▲                                                 ▲                                                ▲
	│                                                │                                                │
private endpoint                 private endpoint                    private endpoint

• suppose a resource has a private endpoint, but its public endpoint is still enabled

• there is a private path but the service may also remain publicly reachable

• appropriate public-network restrictions should be in place

• Azure commonly uses Private DNS zones to support name resolution for private endpoints

hostname
   ↓
DNS resolution
   ↓
private IP
   ↓
private endpoint

• private network troubleshooting includes:

  • private endpoint exists?
  • network connectivity/routing okay?
  • DNS resolves correctly?
  • public access policy correct?
  • identity/RBAC correct?

• Network Security Groups (NSGs) control allowed/denied network traffic for supported subnet/network-interface scenarios unis rules such as:

  • source
  • destination
  • port
  • protocol
  • allow/deny

• it basically serves as a network traffic filter

• service endpoints extend VNet identity/routing to an Azure service over the Azure backbone, service to restrict access to selected VNets/subnets

• On-premise (on-prem) allows private connectivity into the Azure VNet

On-prem network
      ↓
VPN / ExpressRoute
      ↓
Azure VNet
      ↓
Private Endpoint
      ↓
Azure service

• VPN is an encrypted connectivity over the internet between networks/users and Azure
• ExpressRoute is a private dedicated connectivity between on-premises infrastructure and Microsoft cloud connectivity locations, avoiding the public internet path for that connection