This article explains how to enable Azure service endpoints to enhance security by connecting virtual networks to Azure services without exposing data to the public internet.
In this lesson, we explore how to enable service endpoints in Azure and understand how they enhance security by extending your virtual network’s private address space to Azure service resources. Azure service endpoints allow you to securely connect your virtual network to Azure services such as Storage, SQL Database, and more without exposing your data to the public internet.
You have a virtual network (VNet) with a subnet hosting a virtual machine (VM).
The VM has an IP address of 192.168.1.4.
There is a storage account, named “KodeKloud storage account,” which currently has public internet access enabled.
The VM accesses the storage account using a URL like <storage-account-name>.blob.core.windows.net that resolves to a public IP address.
The goal is to restrict public access to the storage account while still allowing the VM to connect securely. This is achieved by:
Blocking all public access through a firewall policy on the storage account.
Allowing access only from the designated subnet in your virtual network via a service endpoint.
The network diagram below illustrates a setup where a VM in a virtual network accesses a storage account over a public IP. With a service endpoint enabled, even though DNS still resolves to a public IP, the source IP is that of the VM’s private IP.
Initially, you configure the storage account to block all public access by enforcing a firewall policy. Although this policy blocks internet access, you explicitly allow communication from the subnet where your VM resides. This means that the VM will be able to connect to the storage account over the service endpoint, using its private IP as the source. Even if the DNS resolves to a public IP address, the traffic remains on the Microsoft Azure backbone network.To summarize:
A VM is set up in your Azure virtual network.
A storage account holding critical data is configured with a firewall that denies public access.
A service endpoint is enabled on the subnet hosting the VM, thereby extending the VNet’s private IP address space to the storage account.
Within the storage account’s network settings, you specify that only the selected subnet can access the storage, ensuring a secure connection via Azure’s backbone network.
This configuration not only enhances security but also optimizes the connection pathway by bypassing the public internet.
Improved Security
Service endpoints restrict access to Azure services (such as Storage or SQL Database) so that only your virtual network can connect to them instead of the entire internet.
Utilization of Microsoft’s Backbone Network
By leveraging Microsoft’s global backbone network, service endpoints ensure that traffic between your VNet and Azure services bypasses the public internet for enhanced security and reliability.
Ease of Setup and Management
Configuring service endpoints is straightforward using the Azure portal, simplifying network security management.
Wide Range of Supported Services
Service endpoints extend support to many Azure services, including Azure Storage, Azure SQL Database, Synapse Analytics, PostgreSQL, Cognitive Services, Container Registry, App Services, and more.
Azure service endpoints secure your connections by ensuring that traffic remains on Microsoft’s private network infrastructure.
In this section, we implement the architecture using the Azure portal. For this demonstration, you will need a VM and a storage account. You can create these resources manually or by using the provided PowerShell script named service-endpoints-prep-infra.ps1.
Wait for the script to execute. Once complete, the storage account and virtual machine will be created as required. The resource group now contains all necessary components, as shown in the Azure portal below:
Setting Up the Storage Container and Uploading Files
Navigate to the storage account in the Azure portal.
Create a new container under the “Containers” section (for example, name it “demo”).
Upload files to the container. Initially, these files are accessible via the public internet, but they will later be protected by the service endpoint configuration.
After uploading a file, copy its URL and test it in a web browser. At this point, the file is accessible publicly.Next, switch to the virtual machine (e.g., VM01) via SSH. In the Azure portal, locate VM01 in your resource group:
Log in to VM01 and download a file from the storage account using the wget command:
Restricting Public Access and Enabling Service Endpoints
Now, secure the storage account by modifying its networking settings:
Go to the storage account’s Networking settings.
Change the configuration from “All networks” to “Selected virtual networks and IP addresses.”
Add the existing virtual network (e.g., VNet01) and select the relevant subnet.
After saving these changes, a service endpoint is automatically created. Consequently, attempting to access the file using a public IP via a browser results in an authorization failure, while the VM continues to access it seamlessly via the service endpoint.To test this:
Open an incognito browser window to confirm that accessing the file results in an authorization error.
From within the VM, download the file again with a similar wget command:
Any attempt to directly access other files through the public endpoint will fail with an authorization error:
Copy
Ask AI
<Error> <Code>AuthorizationFailure</Code> <Message>This request is not authorized to perform this operation. RequestId:d7aa5c5d-801e-001d-3ace-f29ada000000 Time:2023-09-29T12:14:04.6652314Z</Message></Error>
To further verify connectivity, try downloading another file (ensuring the correct file extension is used):
This confirms that even though the endpoint resolved publicly, the VM accesses the file via its private IP on Azure’s backbone network.
After changing the network settings on your storage account, public access will be denied. Ensure that all necessary service endpoints are configured correctly to avoid access issues.
While service endpoints secure access by directing traffic through Azure’s backbone network, private links provide an additional layer of security by mapping the service directly into your virtual network with a private IP. This eliminates exposure to public endpoints altogether.Test private link connectivity with a similar command:
With both service endpoints and private links, your traffic remains on the secure Azure backbone network, ensuring optimal performance and enhanced security.In this lesson, you learned how to configure Azure service endpoints to secure your Storage Account while allowing controlled access from your virtual network. The demonstration covered firewall configuration, network settings via the Azure portal, and connectivity testing via a virtual machine. We also briefly introduced private links as an alternative that further secures your connection by removing public endpoint exposure.Happy configuring!
