Options for Securing VNET Traffic to PaaS Resources in Azure

Historically, one of the challenges of Azure was trying to contain private traffic to resources such as platform-as-a-service (PaaS), Azure files, and Azure SQL. Customers envisioned having a cloud data center with services, and they strived for a vehicle to encapsulate the traffic as they would with a traditional data center.

The only option administrators had was to use service endpoints. Service endpoints were Microsoft’s first efforts to lock down traffic flow by “[enabling] private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.” 

Though these efforts were a step in the right direction, service endpoints still face fundamental issues:

• Traffic to your PaaS would still be leaving your virtual network
• Your Azure PaaS resource is still accessible from the internet

The new standard to remediate this issue is the introduction of private endpoints. According to Microsoft, Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. A private endpoint uses a private IP address from your VNet, effectively bringing the service into your VNet.

With this private network interface (NIC) on your VNet, traffic will pass through a private link to your PaaS environment. This eliminates the need for:

• Gateways
• Network address translation (NAT) devices
• Public IPs

Below is a list of all platforms as a service that can use private links:

Other advantages of private endpoints that should be noted:

• Hybrid environments with express routes and VPNs can leverage private endpoints to contain sensitive traffic within your cloud and on-premise data centers.
• There is inherent protection against data leakage because you are mapping directly to your specific resource rather than to the service.