DNS get private ip from private endpoint

Hi Stefan,

When you are using the Private Endpoint for your Storage Account, you would have a Private DNS Zone (if you want). It's name is like "privatelink.<resource-type>.core.windows.net". If you go the Private DNS Zone resource, you can add the both VNets to this Private DNS Zone. 

As I had a same scenario in one of my projects, I can share the Terraform code, I developed.

resource "azurerm_resource_group" "example" {
  name     = "${var.projectname}-resources"
  location = "West Europe"
}

# -----------------------------------
# VNET 1
# -----------------------------------
resource "azurerm_virtual_network" "example" {
  name                = "${var.projectname}-vnet1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.3.0.0/16"]
  dns_servers         = ["168.63.129.16"]

}

resource "azurerm_subnet" "exampledefault" {
  name                 = "${var.projectname}-default"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.3.1.0/24"]

}

resource "azurerm_subnet" "exampleprivate" {
  name                 = "${var.projectname}-private"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.3.2.0/24"]
  enforce_private_link_endpoint_network_policies = true

}

# -----------------------------------
# VNET 2
# -----------------------------------
resource "azurerm_virtual_network" "example2" {
  name                = "${var.projectname}-vnet2"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.4.0.0/16"]
  dns_servers         = ["168.63.129.16"]

}

resource "azurerm_subnet" "exampledefault2" {
  name                 = "${var.projectname}-default"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example2.name
  address_prefixes     = ["10.4.1.0/24"]

}


# -----------------------------------
# Storage
# -----------------------------------
resource "azurerm_storage_account" "example" {
  name                     ="${var.projectname}stg"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

}


resource "azurerm_storage_account_network_rules" "network_rule_publisher" {
  depends_on = [
    azurerm_private_endpoint.example
  ]

  resource_group_name  = azurerm_resource_group.example.name
  storage_account_name = azurerm_storage_account.example.name

  default_action             = "Deny"
  ip_rules                   = ["127.0.0.1"]
  bypass                     = []
}


// Azure services DNS zone
// https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration
resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.example.name
}



resource "azurerm_private_endpoint" "example" {
  name                = "${var.projectname}-privateendpoint"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  subnet_id           = azurerm_subnet.exampleprivate.id

  private_service_connection {
    name                           = "${var.projectname}-stg-pe-connection"
    is_manual_connection           = false
    private_connection_resource_id = azurerm_storage_account.example.id
    subresource_names              = ["blob"]
  }

  private_dns_zone_group {
    name                 = azurerm_private_dns_zone.example.name
    private_dns_zone_ids = [azurerm_private_dns_zone.example.id]
  }

}


# connect the Private Zone to the VNet
resource "azurerm_private_dns_zone_virtual_network_link" "example" {
  name                  = "${var.projectname}-vnet2dns-1"
  resource_group_name   = azurerm_resource_group.example.name
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  virtual_network_id    = azurerm_virtual_network.example.id
}

resource "azurerm_private_dns_zone_virtual_network_link" "example2" {
  name                  = "${var.projectname}-vnet2dns-2"
  resource_group_name   = azurerm_resource_group.example.name
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  virtual_network_id    = azurerm_virtual_network.example2.id
}


# -----------------------------------
# VM in Vnet1
# -----------------------------------
resource "azurerm_network_interface" "example" {
  name                = "${var.projectname}-nic-1"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.exampleprivate.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_windows_virtual_machine" "example" {
  name                = "${var.projectname}-vm-1"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_F2"
  admin_username      = "adminuser"
  admin_password      = "P@$$w0rd1234!"
  network_interface_ids = [
    azurerm_network_interface.example.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2016-Datacenter"
    version   = "latest"
  }
}


# -----------------------------------
# VM in Vnet2
# -----------------------------------
resource "azurerm_network_interface" "example2" {
  name                = "${var.projectname}-nic-2"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.exampledefault2.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_windows_virtual_machine" "example2" {
  name                = "${var.projectname}-vm-2"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_F2"
  admin_username      = "adminuser"
  admin_password      = "P@$$w0rd1234!"
  network_interface_ids = [
    azurerm_network_interface.example2.id,
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2016-Datacenter"
    version   = "latest"
  }
}



// output "myoutput" {
//   value = azurerm_private_endpoint.example.private_service_connection[0].private_ip_address
// }

// output "dns_id" {
//   value = azurerm_private_dns_zone.example.id
// }

// output "dns_name" {
//   value = azurerm_private_dns_zone.example.name
// }

If you don't want the Storage Account be accessible from Internet/ Public Endpoint, you should configure the Storage Account Networking as follows. The code above does the same configuration for the Storage Account.

Regard

Parisa