Edit

Restrict import and export access for managed disks by using Private Link

Applies to: ✔️ Linux VMs ✔️ Windows VMs ✔️ Flexible scale sets

Use private endpoints to restrict managed disk import and export. Securely access data over Azure Private Link from clients in your Azure virtual network. The private endpoint uses an IP address from your virtual network address space for your managed disks service. Traffic between clients in your virtual network and managed disks stays on the virtual network and Private Link on the Microsoft backbone network, which reduces exposure to the public internet.

This article shows how to configure Private Link for managed disk import and export by using Azure CLI or Azure PowerShell. Create a disk access resource and link it to a virtual network in the same subscription by creating a private endpoint. Then associate a disk or snapshot with the disk access resource. Finally, set the network access policy of the disk or snapshot to AllowPrivate to limit access to your virtual network.

Set the network access policy to DenyAll to prevent anyone from exporting data from a disk or snapshot. The default network access policy is AllowAll.

Prerequisites

Before you begin, install the latest Azure CLI or Azure PowerShell module.

Limitations

  • You can't import or export more than 100 disks or snapshots at the same time with the same disk access resource
  • You can't upload to a disk with both a disk access resource and a disk encryption set
  • In addition to the scale targets that apply to individual disks, disk access resources have more scale targets that are centered around ingress/egress of data. These limits apply cumulatively to all disks associated with a disk access resource. For details see here
  • The disk access resource must be in the same region and subscription as the disk that you associate it with

Sign in and set variables

Choose a tab to use Azure CLI or Azure PowerShell. Set values for your subscription, resource group, region, disk access resource, virtual network, subnet, private endpoint, and private DNS zone. The remaining procedures reuse these variables. To create a protected snapshot, also provide the name of an existing source disk and a name for the new snapshot.

subscriptionId=yourSubscriptionId
resourceGroupName=yourResourceGroupName
region=northcentralus
diskAccessName=yourDiskAccessForPrivateLink
vnetName=yourVnetForPrivateLink
subnetName=yourSubnetForPrivateLink
privateEndpointName=yourPrivateEndpointForSecureMDExportImport
privateEndpointConnectionName=yourPrivateEndpointConnection
privateDnsZoneName=privatelink.blob.core.windows.net
privateDnsZoneLinkName=yourDnsLink
privateDnsZoneGroupName=yourZoneGroup

# The name of an existing disk that is the source of the snapshot.
sourceDiskName=yourSourceDiskForSnapshot

# The name of the new snapshot secured with Private Link.
snapshotNameSecuredWithPrivateLink=yourSnapshotNameSecuredWithPrivateLink

az login
az account set --subscription $subscriptionId

Create a disk access resource

Use the resource group, region, and disk access resource name that you defined earlier. The az disk-access create command creates the disk access resource. Then, az disk-access show stores its resource ID in $diskAccessId for later procedures.

az disk-access create -n $diskAccessName -g $resourceGroupName -l $region

diskAccessId=$(az disk-access show -n $diskAccessName -g $resourceGroupName --query [id] -o tsv)

Create a virtual network

Network policies such as network security groups (NSGs) aren't supported for private endpoints. To deploy a private endpoint on a subnet, disable private endpoint network policies on that subnet.

Use the resource group, virtual network, and subnet names that you defined earlier. The az network vnet create command creates the virtual network and subnet. Then, az network vnet subnet update disables private endpoint network policies on the subnet.

az network vnet create --resource-group $resourceGroupName \
    --name $vnetName \
    --subnet-name $subnetName

az network vnet subnet update --resource-group $resourceGroupName \
    --name $subnetName \
    --vnet-name $vnetName \
    --private-endpoint-network-policies Disabled

Create a private endpoint for the disk access resource

Use the resource group, private endpoint, virtual network, subnet, and connection names that you defined earlier. This procedure also uses $diskAccessId from the disk access resource procedure. The az network private-endpoint create command creates a private endpoint for the disk access resource.

az network private-endpoint create --resource-group $resourceGroupName \
    --name $privateEndpointName \
    --vnet-name $vnetName \
    --subnet $subnetName \
    --private-connection-resource-id $diskAccessId \
    --group-ids disks \
    --connection-name $privateEndpointConnectionName

Configure the private DNS zone

Create a private DNS zone for the storage blob domain, create a virtual network link, and then create a DNS zone group that associates the private endpoint with the private DNS zone.

Use the resource group, private DNS zone, virtual network link, private endpoint, and DNS zone group names that you defined earlier. The following commands create the private DNS zone, link it to the virtual network, and associate it with the private endpoint.

az network private-dns zone create --resource-group $resourceGroupName \
    --name $privateDnsZoneName

az network private-dns link vnet create --resource-group $resourceGroupName \
    --zone-name $privateDnsZoneName \
    --name $privateDnsZoneLinkName \
    --virtual-network $vnetName \
    --registration-enabled false

az network private-endpoint dns-zone-group create \
   --resource-group $resourceGroupName \
    --endpoint-name $privateEndpointName \
   --name $privateDnsZoneGroupName \
   --private-dns-zone $privateDnsZoneName \
   --zone-name disks

Define the managed disk name, storage SKU, and size for this procedure. The procedure reuses the resource group, region, and disk access resource name that you defined earlier. The az disk create command creates an empty managed disk, associates it with the disk access resource, and sets its network access policy to AllowPrivate.

# These variables are specific to this step.
diskName=yourDiskName
diskSkuName=Standard_LRS
diskSizeGB=128

diskAccessId=$(az resource show -n $diskAccessName -g $resourceGroupName --namespace Microsoft.Compute --resource-type diskAccesses --query [id] -o tsv)

az disk create -n $diskName \
    -g $resourceGroupName \
    -l $region \
    --size-gb $diskSizeGB \
    --sku $diskSkuName \
    --network-access-policy AllowPrivate \
    --disk-access $diskAccessId

Use the existing source disk, new snapshot, resource group, region, and disk access resource names that you defined earlier. The az disk show command gets the source disk ID. Then, az snapshot create creates the snapshot, associates it with the disk access resource, and sets its network access policy to AllowPrivate.

# This step reuses variables defined in the first CLI sample.

diskId=$(az disk show -n $sourceDiskName -g $resourceGroupName --query [id] -o tsv)

diskAccessId=$(az resource show -n $diskAccessName -g $resourceGroupName --namespace Microsoft.Compute --resource-type diskAccesses --query [id] -o tsv)

az snapshot create -n $snapshotNameSecuredWithPrivateLink \
    -g $resourceGroupName \
    -l $region \
    --source $diskId \
    --network-access-policy AllowPrivate \
    --disk-access $diskAccessId

Next steps

  • Last updated on