Home
%3CLINGO-SUB%20id%3D%22lingo-sub-1093244%22%20slang%3D%22en-US%22%3EIntroducing%20Private%20Link%20for%20Azure%20Database%20for%20MySQL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1093244%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EThrough%20the%20rapidly%20growing%20adoption%20of%20open%20source%20databases%2C%20customers%20need%20to%20access%20the%20data%20and%20services%20privately%20and%20securely%20from%20their%20networks%20grow%20exponentially.%20We%20have%20been%20incrementally%20adding%20support%20for%20network%20isolation%20through%20Firewall%20rules%20followed%20by%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fblog%2Fvnet-service-endpoints-for-azure-database-services-for-mysql-and-postgresql-in-preview%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EVNet%20Service%20endpoints%3C%2FA%3E%3CSPAN%3E.%20Today%20we%20are%20excited%20to%20announce%20the%20public%20preview%20of%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fblog%2Fannouncing-azure-private-link%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Private%20Link%3C%2FA%3E%3CSPAN%3E%26nbsp%3Bsupport%20for%20the%20Azure%20database%20for%20MySQL.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CSPAN%3EAzure%20Private%20Link%20is%20a%20secure%20and%20scalable%20way%20for%20Azure%20customers%20to%20consume%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22http%3A%2F%2Faka.ms%2Fmysql%22%20target%3D%22_self%22%20rel%3D%22noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20database%20for%20MySQL%3C%2FA%3E%3CSPAN%3E%26nbsp%3Bservice%20privately%20from%20their%20Azure%20Virtual%20Network%20(VNet).%20The%20technology%20is%20based%20on%20a%20provider%20and%20consumer%20model%20where%20the%20provider%20and%20the%20consumer%20are%20both%20hosted%20in%20Azure.%20A%20connection%20is%20established%20using%20a%20consent-based%20call%20flow%20and%20once%20established%2C%20all%20data%20that%20flows%20between%20the%20service%20provider%20and%20service%20consumer%20is%20isolated%20from%20the%20internet%20and%20stays%20on%20the%20Microsoft%20network.%20There%20is%20no%20need%20for%20gateways%2C%20network%20address%20translation%20(NAT)%20devices%2C%20or%20public%20IP%20addresses%20to%20communicate%20with%20the%20service.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EAzure%20Private%20Link%20essentially%20brings%20Azure%20services%20inside%20the%20customer%E2%80%99s%20private%20VNet.%20The%20MySQL%20resources%20can%20be%20accessed%20using%20the%20private%20IP%20address%20just%20like%20any%20other%20resource%20in%20the%20VNet.%20This%20significantly%20simplifies%20the%20network%20configuration%20by%20keeping%20access%20rules%20private.%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164781i39056E52E788DA1B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22architecture.PNG%22%20title%3D%22architecture.PNG%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%3CFONT%20size%3D%222%22%3E%3CEM%3E%3CSTRONG%3EAzure%20private%20link%20%E2%80%93%20connecting%20Azure%20Database%20for%20MySQL%20privately%20from%20your%20network%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FFONT%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3EBenefits%20of%20using%20private%20link%20for%20Azure%20Database%20for%20MySQL%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EData%20exfiltration%20protection%3A%3C%2FSTRONG%3E%20With%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fmysql%2Fconcepts-data-access-security-private-link%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EPrivate%20Link%20for%20Azure%20Database%20for%20MySQL%3C%2FA%3E%2C%20customers%20can%20now%20set%20up%20network%20access%20controls%20like%20NSGs%20to%20restrict%20access%20to%20the%20private%20endpoint.%20Individual%20Azure%20PaaS%20resources%20are%20then%20mapped%20to%20specific%20private%20endpoints.%20A%20malicious%20insider%20can%20only%20access%20the%20mapped%20PaaS%20resource%20(for%20example%20an%20Azure%20Database%20for%20MySQL)%20and%20no%20other%20resource.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EPrivate%20on-premises%20access%3A%3C%2FSTRONG%3E%20Since%20Azure%20Database%20for%20MySQL%20is%20mapped%20to%20private%20IP%20addresses%20in%20the%20customer%E2%80%99s%20VNet%2C%20they%20can%20be%20accessed%20via%20Azure%20ExpressRoute%20private%20peering.%20This%20effectively%20means%20that%20the%20data%20will%20traverse%20a%20fully%20private%20path%20from%20on-premises%20to%20Azure.%20The%20configuration%20in%20the%20corporate%20firewalls%20and%20route%20tables%20can%20be%20simplified%20to%20allow%20access%20only%20to%20the%20private%20IP%20addresses.%20With%20Private%20Link%2C%20customers%20can%20enable%20cross-premises%20access%20to%20the%20private%20endpoint%20using%20%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fservices%2Fexpressroute%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EExpress%20Route%20(ER)%3C%2FA%3E%2C%20private%20peering%20or%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fvpn-gateway%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EVPN%20tunnel%3C%2FA%3E.%20They%20can%20subsequently%20disable%20all%20access%20via%20public%20endpoint%20and%20not%20use%20the%20IP-based%20firewall.%20Please%20refer%20to%20the%20blog%20on%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-database-for-mysql%2Fusing-private-link-and-point-to-site-gateway-for-secure-on%2Fba-p%2F1108953%22%20target%3D%22_self%22%3EUsing%20private%20link%20with%20VPN%20tunnel%20and%20Private%20Endpoint%20to%20access%20your%20Azure%20Database%20for%20MySQL.%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3ESimple%20to%20setup%3A%3C%2FSTRONG%3E%20Azure%20Private%20Link%20for%20Azure%20Database%20for%20MySQL%20is%20simple%20to%20setup%20with%20minimal%20networking%20configuration%20needed.%20Connectivity%20works%20on%20an%20approval%20call%20flow%20and%20once%20a%20MySQL%20resource%20is%20mapped%20to%20a%20private%20endpoint%2C%20the%20connectivity%20works%20out%20of%20the%20box%20without%20any%20additional%20configurations%20on%20route%20tables%20and%20Azure%20Network%20Security%20Groups%20(NSGs).%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EHow%20to%20setup%20private%20link%20for%20Azure%20Database%20for%20MySQL%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EWe%20will%20learn%20how%20to%20setup%20a%20private%20link%20for%20your%3CA%20href%3D%22http%3A%2F%2Faka.ms%2Fmysql%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Azure%20Database%20for%20MySQL%3C%2FA%3E%20and%20use%20a%20Azure%20VM%20to%20access%20it%20securely%20using%20the%20private%20link.%20We%20can%20use%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fmysql%2Fhowto-configure-privatelink-portal%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EPortal%3C%2FA%3E%20or%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fmysql%2Fhowto-configure-privatelink-cli%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3ECLI%3C%2FA%3E%20to%20setup%20the%20private%20link.%20Here%20I%20have%20shown%20setting%20up%20private%20link%20using%20Azure%20portal.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EStep%201%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EOn%20the%20upper-left%20side%20of%20the%20screen%20in%20the%20Azure%20portal%2C%20select%26nbsp%3B%3CSTRONG%3ECreate%20a%20resource%3C%2FSTRONG%3E%26nbsp%3B%26gt%3B%26nbsp%3B%3CSTRONG%3ENetworking%3C%2FSTRONG%3E%26nbsp%3B%26gt%3B%26nbsp%3B%3CSTRONG%3EPrivate%20Link%20Center%20(Preview)%3C%2FSTRONG%3E.%3C%2FLI%3E%0A%3CLI%3EIn%26nbsp%3B%3CSTRONG%3EPrivate%26nbsp%3BLink%26nbsp%3BCenter%26nbsp%3B-%26nbsp%3BOverview%3C%2FSTRONG%3E%2C%26nbsp%3Bon%26nbsp%3Bthe%26nbsp%3Boption%26nbsp%3Bto%26nbsp%3B%3CSTRONG%3EBuild%26nbsp%3Ba%26nbsp%3Bprivate%26nbsp%3Bconnection%26nbsp%3Bto%26nbsp%3Ba%26nbsp%3Bservice%3C%2FSTRONG%3E%2C%26nbsp%3Bselect%26nbsp%3B%3CSTRONG%3EStart%3C%2FSTRONG%3E.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22100%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3ESetting%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3EValue%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3EProject%20details%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESubscriptions%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20your%20subscription%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EResource%20group%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%26nbsp%3B%3CSTRONG%3EmyResourceGroup%3C%2FSTRONG%3E.%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3EINSTANCE%20DETAILS%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EName%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EEnter%26nbsp%3B%3CEM%3EmyPrivateEndpoint%3C%2FEM%3E.%20If%20this%20name%20is%20taken%2C%20create%20a%20unique%20name%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ERegion%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%26nbsp%3B%3CSTRONG%3ERegionName%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20652px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164783i25BECF6B1535811E%2Fimage-dimensions%2F652x318%3Fv%3D1.0%22%20width%3D%22652%22%20height%3D%22318%22%20alt%3D%22intialscreen.PNG%22%20title%3D%22intialscreen.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EStep%202%3A%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3BIn%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3ECreate%20a%20private%20endpoint%20(Preview)%20-%20Basics%3C%2FSTRONG%3E%3CSPAN%3E%2C%20enter%20or%20select%20this%20information%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20654px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164784i5C8EF0E8D436216E%2Fimage-dimensions%2F654x378%3Fv%3D1.0%22%20width%3D%22654%22%20height%3D%22378%22%20alt%3D%22privatelink1.PNG%22%20title%3D%22privatelink1.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EStep%203%3A%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3ESelect%26nbsp%3B%3CSTRONG%3ENext%3A%20Resource%3C%2FSTRONG%3E.%20In%26nbsp%3BCreate%20a%20private%20endpoint%20-%20Resource%2C%20enter%20or%20select%20this%20information%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22100%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3ESettings%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3EValue%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EConnection%20method%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20connect%20to%20an%20Azure%20resource%20in%20my%20directory%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESubscription%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20your%20subscription%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EResource%20type%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EMicrosoft.DBforMySQL%2Fservers%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EResource%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20%3CMYSERVERNAME%3E%3C%2FMYSERVERNAME%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ETarget%20sub-resource%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20mysqlServer%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20658px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164785iF44A1ECE8666A215%2Fimage-dimensions%2F658x373%3Fv%3D1.0%22%20width%3D%22658%22%20height%3D%22373%22%20alt%3D%22privatelink2.PNG%22%20title%3D%22privatelink2.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EStep%204%3A%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3EIn%26nbsp%3B%3CSTRONG%3ECreate%20a%20private%20endpoint%20(Preview)%20-%20Configuration%3C%2FSTRONG%3E%2C%20enter%20or%20select%20this%20information%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3ENETWORKING%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EVirtual%20Network%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20MyVirtualNetwork%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESubnet%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%E2%80%AFmySubnet%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%3CSTRONG%3EPRIVATE%20DNS%20INTEGRATION%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EIntegrate%20with%20private%20DNS%20Zone%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20Yes%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3EPrivate%20DNS%20Zone%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20width%3D%2250%25%22%3E%3CP%3ESelect%20(new)%20privatelink.database.azure.com%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20650px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164786i1657C3331950E7A2%2Fimage-dimensions%2F650x416%3Fv%3D1.0%22%20width%3D%22650%22%20height%3D%22416%22%20alt%3D%22privatelink3.PNG%22%20title%3D%22privatelink3.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EStep%205%3A%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3BSelect%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EReview%20%2B%20create%3C%2FSTRONG%3E%3CSPAN%3E.%20You're%20taken%20to%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EReview%20%2B%20create%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3Bpage%20where%20Azure%20validates%20your%20configuration.%20The%20private%20link%20overview%20shows%20the%20mapped%20MySQL%20resource.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20666px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164787i24B8FA0A6CB7CA4E%2Fimage-dimensions%2F666x258%3Fv%3D1.0%22%20width%3D%22666%22%20height%3D%22258%22%20alt%3D%22privatelinkoverview.PNG%22%20title%3D%22privatelinkoverview.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3Everify%20that%20the%20private%20link%20points%20to%20the%20MySQL%20resource%20and%20the%20necessary%20resolution%20is%20happening.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3E..%5Cazureadmin%26gt%3B%20nslookup%20demomysqlserver.mysql.privatelink.database.azure.com%0A%0AServer%3A%20%20UnKnown%0AAddress%3A%20%20168.63.129.16%0A%0ANon-authoritative%20answer%3A%0AName%3A%20%20%20%20demomysqlserver.mysql.privatelink.database.azure.com%0AAddress%3A%20%2010.1.3.5%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EAzure%20Database%20for%20MySQL%20private%20link%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20666px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164788iA12303C32573F246%2Fimage-dimensions%2F666x361%3Fv%3D1.0%22%20width%3D%22666%22%20height%3D%22361%22%20alt%3D%22mysqlprinvatelink.PNG%22%20title%3D%22mysqlprinvatelink.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ENow%2C%20in%20order%20to%20connect%20to%20the%20MySQL%20resource%2C%20you%20can%20directly%20use%20the%20IP%20available%20(10.1.3.5)%20and%20provide%20the%20required%20credentials%20for%20the%20database%20server.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3EIn%20the%20example%20below%20I%20am%20using%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdev.mysql.com%2Fdoc%2Fworkbench%2Fwb-installing-windows.html%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20data-linktype%3D%22external%22%3EMySQL%20Workbench%3C%2FA%3E%3CSPAN%3E%26nbsp%3Bto%20connect%20to%20the%20database%20server.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20654px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F164789i0664C9B95A75B646%2Fimage-dimensions%2F654x439%3Fv%3D1.0%22%20width%3D%22654%22%20height%3D%22439%22%20alt%3D%22workbench.PNG%22%20title%3D%22workbench.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20also%20pass%20the%20server%20name%20in%20the%20host%20name%20field%20above%20demomysqlserverprivate.mysql.privatelink.database.azure.com%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3ELearn%20More%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20can%20find%20more%20details%20on%20the%20private%20link%20for%20Azure%20Database%20for%20MySQL%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fmysql%2Fconcepts-data-access-security-private-link%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%20%3CSPAN%3EYou%20can%20give%20the%20Azure%20Private%20Link%20integration%20a%20try%20today.%26nbsp%3B%3C%2FSPAN%3EIf%20you%20have%20questions%2C%20please%20reach%20out%20to%20the%20AskAzureDBforMySQL%40service.microsoft.com%20alias.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBlog%20%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-database-for-mysql%2Fusing-private-link-and-point-to-site-gateway-for-secure-on%2Fba-p%2F1108953%22%20target%3D%22_self%22%3ESetting%20Private%20link%20for%20on-prem%20resource%20connectivity%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1093244%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20private%20link%20%E2%80%93%20connecting%20Azure%20Database%20for%20MySQL%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

Through the rapidly growing adoption of open source databases, customers need to access the data and services privately and securely from their networks grow exponentially. We have been incrementally adding support for network isolation through Firewall rules followed by VNet Service endpoints. Today we are excited to announce the public preview of Azure Private Link support for the Azure database for MySQL.


Azure Private Link is a secure and scalable way for Azure customers to consume Azure database for MySQL service privately from their Azure Virtual Network (VNet). The technology is based on a provider and consumer model where the provider and the consumer are both hosted in Azure. A connection is established using a consent-based call flow and once established, all data that flows between the service provider and service consumer is isolated from the internet and stays on the Microsoft network. There is no need for gateways, network address translation (NAT) devices, or public IP addresses to communicate with the service.


Azure Private Link essentially brings Azure services inside the customer’s private VNet. The MySQL resources can be accessed using the private IP address just like any other resource in the VNet. This significantly simplifies the network configuration by keeping access rules private.
architecture.PNG
                              Azure private link – connecting Azure Database for MySQL privately from your network

Benefits of using private link for Azure Database for MySQL

 

  • Data exfiltration protection: With Private Link for Azure Database for MySQL, customers can now set up network access controls like NSGs to restrict access to the private endpoint. Individual Azure PaaS resources are then mapped to specific private endpoints. A malicious insider can only access the mapped PaaS resource (for example an Azure Database for MySQL) and no other resource.

 

  • Private on-premises access: Since Azure Database for MySQL is mapped to private IP addresses in the customer’s VNet, they can be accessed via Azure ExpressRoute private peering. This effectively means that the data will traverse a fully private path from on-premises to Azure. The configuration in the corporate firewalls and route tables can be simplified to allow access only to the private IP addresses. With Private Link, customers can enable cross-premises access to the private endpoint using Express Route (ER), private peering or VPN tunnel. They can subsequently disable all access via public endpoint and not use the IP-based firewall. Please refer to the blog on Using private link with VPN tunnel and Private Endpoint to access your Azure Database for MySQL.

 

  • Simple to setup: Azure Private Link for Azure Database for MySQL is simple to setup with minimal networking configuration needed. Connectivity works on an approval call flow and once a MySQL resource is mapped to a private endpoint, the connectivity works out of the box without any additional configurations on route tables and Azure Network Security Groups (NSGs).

How to setup private link for Azure Database for MySQL


We will learn how to setup a private link for your Azure Database for MySQL and use a Azure VM to access it securely using the private link. We can use Portal or CLI to setup the private link. Here I have shown setting up private link using Azure portal.

 

Step 1:

  1. On the upper-left side of the screen in the Azure portal, select Create a resource > Networking > Private Link Center (Preview).
  2. In Private Link Center - Overview, on the option to Build a private connection to a service, select Start.

 

Setting

Value

Project details

 

Subscriptions

Select your subscription

Resource group

Select myResourceGroup

 

 

INSTANCE DETAILS

 

Name

Enter myPrivateEndpoint. If this name is taken, create a unique name

Region

Select RegionName

 

intialscreen.PNG

 

Step 2: In Create a private endpoint (Preview) - Basics, enter or select this information:

 

privatelink1.PNG

 

Step 3: Select Next: Resource. In Create a private endpoint - Resource, enter or select this information:

 

Settings

Value

Connection method

Select connect to an Azure resource in my directory

Subscription

Select your subscription

Resource type

Select Microsoft.DBforMySQL/servers

Resource

Select <myServername>

Target sub-resource

Select mysqlServer

 

privatelink2.PNG

 

Step 4: In Create a private endpoint (Preview) - Configuration, enter or select this information

 

NETWORKING

 

Virtual Network

Select MyVirtualNetwork

Subnet

Select mySubnet

 

 

PRIVATE DNS INTEGRATION

 

Integrate with private DNS Zone

Select Yes

Private DNS Zone

Select (new) privatelink.database.azure.com

 

privatelink3.PNG

 

Step 5: Select Review + create. You're taken to the Review + create page where Azure validates your configuration. The private link overview shows the mapped MySQL resource.

 

privatelinkoverview.PNG

verify that the private link points to the MySQL resource and the necessary resolution is happening.

 

 

 

..\azureadmin> nslookup demomysqlserver.mysql.privatelink.database.azure.com

Server:  UnKnown
Address:  168.63.129.16

Non-authoritative answer:
Name:    demomysqlserver.mysql.privatelink.database.azure.com
Address:  10.1.3.5

 

 

Azure Database for MySQL private link

 

mysqlprinvatelink.PNG

 

Now, in order to connect to the MySQL resource, you can directly use the IP available (10.1.3.5) and provide the required credentials for the database server. In the example below I am using MySQL Workbench to connect to the database server.


workbench.PNG

 

You can also pass the server name in the host name field above demomysqlserverprivate.mysql.privatelink.database.azure.com

Learn More

You can find more details on the private link for Azure Database for MySQL here. You can give the Azure Private Link integration a try today. If you have questions, please reach out to the AskAzureDBforMySQL@service.microsoft.com alias. 

 

Blog : Setting Private link for on-prem resource connectivity.