How to securely publish messages from AWS Lambda (with no vpc endpoint configured) to Azure Service Bus via private endpoint

Question

How to securely publish messages from AWS Lambda (with no vpc endpoint configured) to Azure Service Bus via private endpoint

jantz 5

Dear Azure Community

I'm working on a project where I need to have an AWS Lambda function publish messages to an Azure Service Bus topic configured behind a private endpoint, without using the internet. My goal is to use Azure Private Link to achieve this.

Could you provide guidance on:

Setting up the necessary configurations in AWS and Azure to establish this connection.

Ensuring the communication is secure and private
Any best practices or potential pitfalls to be aware of.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T11:58:04.2633333+00:00

You want Lambda to reach Service Bus through a private endpoint while Lambda has no VPC connectivity and no public Internet path. That combination cannot work: a Service Bus private endpoint is a private IP inside an Azure VNet, so the caller must have routed network and DNS reachability to that VNet. Attach the Lambda function to an AWS VPC, connect that VPC to Azure through a site-to-site VPN or ExpressRoute partner, with nonoverlapping ranges. Then configure DNS forwarding so the namespace’s normal Service Bus name resolves to the private endpoint address from AWS, and test TCP 5671 or 443 plus routing and security rules. Disable public network access only after the private path succeeds. If Lambda must remain outside a VPC, the supported alternative is the Service Bus public endpoint over TLS, protected with Microsoft Entra authentication or scoped SAS credentials and firewall rules; it is not private-endpoint traffic.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T11:58:04.2633333+00:00

You want Lambda to reach Service Bus through a private endpoint while Lambda has no VPC connectivity and no public Internet path. That combination cannot work: a Service Bus private endpoint is a private IP inside an Azure VNet, so the caller must have routed network and DNS reachability to that VNet. Attach the Lambda function to an AWS VPC, connect that VPC to Azure through a site-to-site VPN or ExpressRoute partner, with nonoverlapping ranges. Then configure DNS forwarding so the namespace’s normal Service Bus name resolves to the private endpoint address from AWS, and test TCP 5671 or 443 plus routing and security rules. Disable public network access only after the private path succeeds. If Lambda must remain outside a VPC, the supported alternative is the Service Bus public endpoint over TLS, protected with Microsoft Entra authentication or scoped SAS credentials and firewall rules; it is not private-endpoint traffic.