Edit

Restrict managed disk import and export with Private Links

Applies to: ✔️ Linux VMs ✔️ Windows VMs ✔️ Flexible scale sets

Use private endpoints to restrict managed disk import and export. Securely access data over Private Link from clients in your Azure virtual network. The private endpoint uses an IP address from your virtual network address space for your managed disks service. Traffic between clients in your virtual network and managed disks stays on the virtual network and a private link on the Microsoft backbone network, which reduces exposure to the public internet.

To use Private Links for managed disk import or export, create a disk access resource and link it to a virtual network in the same subscription by creating a private endpoint. Then associate a disk or snapshot with a disk access resource. Finally, set the network access policy of the disk or snapshot to AllowPrivate to limit access to your virtual network.

Set the network access policy to DenyAll to prevent anyone from exporting data from a disk or snapshot. The default network access policy is AllowAll.

Prerequisites

Before you begin, install the latest Azure CLI or Azure PowerShell module.

Limitations

  • You can't import or export more than 100 disks or snapshots at the same time with the same disk access resource
  • You can't upload to a disk with both a disk access resource and a disk encryption set
  • In addition to the scale targets that apply to individual disks, disk access resources have more scale targets that are centered around ingress/egress of data. These limits apply cumulatively to all disks associated with a disk access resource. For details see here
  • The disk access resource must be in the same region and subscription as the disk that you associate it with

Sign in and set variables

Choose a tab to use Azure CLI or Azure PowerShell.

subscriptionId=yourSubscriptionId
resourceGroupName=yourResourceGroupName
region=northcentralus
diskAccessName=yourDiskAccessForPrivateLinks
vnetName=yourVNETForPrivateLinks
subnetName=yourSubnetForPrivateLinks
privateEndPointName=yourPrivateLinkForSecureMDExportImport
privateEndPointConnectionName=yourPrivateLinkConnection
privateDnsZoneName=privatelink.blob.core.windows.net
privateDnsZoneLinkName=yourDNSLink
privateDnsZoneGroupName=yourZoneGroup

# The name of an existing disk that is the source of the snapshot.
sourceDiskName=yourSourceDiskForSnapshot

# The name of the new snapshot secured with Private Links.
snapshotNameSecuredWithPL=yourSnapshotNameSecuredWithPL

az login
az account set --subscription $subscriptionId

Create a disk access resource

az disk-access create -n $diskAccessName -g $resourceGroupName -l $region

diskAccessId=$(az disk-access show -n $diskAccessName -g $resourceGroupName --query [id] -o tsv)

Create a virtual network

Network policies such as network security groups (NSGs) aren't supported for private endpoints. To deploy a private endpoint on a subnet, disable private endpoint network policies on that subnet.

az network vnet create --resource-group $resourceGroupName \
    --name $vnetName \
    --subnet-name $subnetName

az network vnet subnet update --resource-group $resourceGroupName \
    --name $subnetName \
    --vnet-name $vnetName \
    --private-endpoint-network-policies Disabled

Create a private endpoint for the disk access resource

az network private-endpoint create --resource-group $resourceGroupName \
    --name $privateEndPointName \
    --vnet-name $vnetName \
    --subnet $subnetName \
    --private-connection-resource-id $diskAccessId \
    --group-ids disks \
    --connection-name $privateEndPointConnectionName

Configure the private DNS zone

Create a private DNS zone for the storage blob domain, create a virtual network link, and then create a DNS zone group that associates the private endpoint with the private DNS zone.

az network private-dns zone create --resource-group $resourceGroupName \
    --name $privateDnsZoneName

az network private-dns link vnet create --resource-group $resourceGroupName \
    --zone-name $privateDnsZoneName \
    --name $privateDnsZoneLinkName \
    --virtual-network $vnetName \
    --registration-enabled false

az network private-endpoint dns-zone-group create \
   --resource-group $resourceGroupName \
   --endpoint-name $privateEndPointName \
   --name $privateDnsZoneGroupName \
   --private-dns-zone $privateDnsZoneName \
   --zone-name disks

# These variables are specific to this step.
diskName=yourDiskName
diskSkuName=Standard_LRS
diskSizeGB=128

diskAccessId=$(az resource show -n $diskAccessName -g $resourceGroupName --namespace Microsoft.Compute --resource-type diskAccesses --query [id] -o tsv)

az disk create -n $diskName \
    -g $resourceGroupName \
    -l $region \
    --size-gb $diskSizeGB \
    --sku $diskSkuName \
    --network-access-policy AllowPrivate \
    --disk-access $diskAccessId

# This step reuses variables defined in the first CLI sample.

diskId=$(az disk show -n $sourceDiskName -g $resourceGroupName --query [id] -o tsv)

diskAccessId=$(az resource show -n $diskAccessName -g $resourceGroupName --namespace Microsoft.Compute --resource-type diskAccesses --query [id] -o tsv)

az snapshot create -n $snapshotNameSecuredWithPL \
    -g $resourceGroupName \
    -l $region \
    --source $diskId \
    --network-access-policy AllowPrivate \
    --disk-access $diskAccessId

Next steps

  • Last updated on