People often ask what they should use to secure the connection between Azure PaaS services and VNETs. Today's article talks about the key differences between Azure Private Link and Azure Service Endpoints and when you should use each of them.
What is?
Azure Service Endpoint provides a direct and secure connection
to Azure PaaS services over the Azure backbone network. Even if the traffic leaves
your VNET and hits the public endpoint of the Azure PaaS service, it goes over the
Azure backbone.
Azure Private Link enables you to have a private IP
inside your VNET used to hit the endpoint of your Azure PaaS service. The assigned
private IP is part of your VNET and ensures that all traffic will stay within
your VNET.
What about Azure Private Endpoint? It is part of Azure Private Link, enabling you to configure the private IP address and the peering over VPN or VNET.
If you want to expose your own service over Private Link, you can do this by using Azure Private Link Service, but you need a Standard Load Balancer (ILB/PLB) to create the Private Link. It's an excellent service if you want to share your service with other consumers in secure manure.
Sometimes Azure resources have support only for Private Link or Service Endpoint, not for both. You should not design a solution that uses only one of them.
Concerns
The section covers the most important infrastructure and security concerns that we should consider when we decide what approach we would like to use.
Connectivity
Private Link - Azure PaaS service receives a private IP from your networks used for communication with your VNET
Service Endpoint - Azure PaaS public IP it is still used, the trafic between VNET and the public IP of Azure PaaS service goes over Azure backbokne network
OnPrem Connectivity
Private Link - ExpressRoute and VPN tunnels provide support to extend the private Azure PaaS connectivity to the OnPrem networks
Service Endpoint - No native support for OnPrem integrations. Build mainly for Azure VNETs.
Cost
Private Link - The cost is based on inboud, outbound traffic and no. of endpoints. Depending on the total traffic, the total cost can grow easilty
Service Endpoint - No additional cost (free of use)
Data protection
Private Link - Build-in data protection
Service Endpoint - Needs to be integrated with a Network Virtual Appliance/Firewall of exfiltration protection is required
Availability
Private Link - The no. of Azure PaaS services supported by Private Link is high and is grow each month - full list of Azure PaaS Services available here.
Service Endpoint - Well supported by core Azure PaaS Services - full list of Azure PaaS Services available here.
UDRs and NSGs
Private Link - The traffic can bypass the Private Endpoint of you use UDRs and NSGs. Special configuration might be required
Service Endpoint - No specific overlaps exists
Complexity
Private Link - Involves updates to DNS (Azure Private DNS) and where the service will attach to your VNET.
Service Endpoint - Easy to configure and setup from Azure Portal
Cross-region support
Private Link - Has full support for access resources across regions and across Azure AD tenants
Service Endpoint - No native support for cross-region support
Conclusion
When security and data restrictions are your main concerns, Azure Private Link should be your first choice. It is superior compared to Azure Service Endpoint, even if the setup complexity is higher.
Comments
Post a Comment