Azure Private Endpoint (Private Link)

azure-private-endpoint

An Azure Private Endpoint (Private Link) to a target PaaS resource — a Storage Account, Key Vault, Azure SQL, App Service, and so on. The endpoint gives the service a private IP inside your VNet so traffic stays on the Microsoft backbone and never traverses the public internet.

It works two ways:

• Production wiring — point it at an existing subnet (subnet_id) and an existing target (target_resource_id).
• Self-contained — set create_network = true to build a dedicated VNet + subnet, and/or create_demo_target = true to stand up a locked-down demo Storage Account target. With both on, one tofu apply yields a complete Private Link example (VNet + subnet + storage + endpoint), and tofu destroy removes it all.

Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0, random >= 3.0, < 4.0.

What it provisions

• azurerm_private_endpoint — the endpoint + its auto-created NIC, with a private_service_connection to the target's chosen subresource_names.
• (optional, create_network) azurerm_virtual_network + azurerm_subnet (subnet has private_endpoint_network_policies = "Disabled").
• (optional, create_demo_target) azurerm_storage_account — public access off, shared keys off, TLS 1.2+, infrastructure (double) encryption on, blob/container soft delete (7 days) on — named uniquely via random_string.
• (optional, create_private_dns_zone) azurerm_private_dns_zone and, when a network is also created, an azurerm_private_dns_zone_virtual_network_link, with the endpoint's records registered automatically.

Security notes

• The connection auto-approves for first-party (same-tenant) targets. Set is_manual_connection = true (+ request_message) only for cross-tenant / cross-subscription targets you do not own; the owner must approve.
• The built-in demo target is secure by default: public network access off (reachable only through the endpoint), shared keys off (Entra-ID auth), TLS 1.2+, infrastructure (double) encryption on, and blob/container soft delete (7 days) on.
• Module-created subnets disable private-endpoint network policies so the endpoint attaches; if you supply your own subnet_id, ensure the same on it.
• Name resolution: attach a private DNS zone (private_dns_zone_ids or create_private_dns_zone) so clients resolve the service FQDN to the private IP; otherwise consume custom_dns_configs from the outputs.

Requirements

Requirement	Version
Terraform / OpenTofu	>= 1.6
hashicorp/azurerm	>= 4.0, < 5.0
hashicorp/random	>= 3.0, < 4.0

Authenticate via az login (or a service principal) and set ARM_SUBSCRIPTION_ID. See docs/CONNECTING-PROVIDERS.md#azure.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).