Secure Communication Between 2 PaaS Services Using Private Endpoints

Question

Assume we have 2 PaaS Services (e.g. one App Service instance and one SQL DB instance).
How can we safely secure the connection between them such that ONLY that one instance of the App Service can communicate with the specific instance of SQL DB?

Idea:

1. Create VNet.
2. Integrate App Service & SQL DB in the VNet.
3. Create one private endpoint (OR service endpoint) for the App Service.
4. Restrict network access to SQL DB such that ONLY the private/service endpoint of App Service is whitelisted.

Are there any other, better or perhaps cheaper alternatives here?

Answer 1

Hi,

There is another option to have a static outbound ip for your app service and then whilelist that ip in your SQL dB:

https://learn.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips#get-a-static-outbound-ip

Hope this helps!