Tutorial 1-5: Create enclave or community endpoint resources in Azure Enclave

Community endpoints enable enclaves in a community to establish connections to resources outside of the community boundary to include public websites, public IP addresses, and external private networks through Site-to-Site (S2S) VPN or ExpressRoute connections. Enclave endpoints enable others to connect to your service by defining the means by which inbound traffic is allowed to flow into a given enclave once a connection is made.

In this tutorial, part six of eight, you create community and enclave endpoint resources. You learn how to:

• Create community endpoint resources in communities
• Create enclave endpoint resources in enclaves
• View your endpoints in the Azure portal

Before you begin

In the previous tutorials, you created a community and an enclave using the Azure portal.

Create an enclave endpoint

1. Navigate to an enclave hosting a service you want to make available to other enclaves in the community

2. While in your enclave's page, select Enclave Endpoints on the left side, and select Create.

   

3. Enter your enclave endpoint name and then select Next:

   • Enclave endpoint name: Name of the enclave endpoint ee-MyService

4. Enter the endpoint rules for your app:

   • Select + Add to add Endpoint Rules that represent how to access your app
     • Rule Name: WebAppEndpointRules
     • Destination IP/CIDR range: <See the information box that gives your enclave webapp-subnet range (for example 10.0.2.0/26) and make sure there are no commas at the end>
     • Protocol: ANY
     • Port: 443

   

5. Select Save, select Review + Create, and select Create

6. After the portal creates the endpoint resource, you can view it in the Azure portal from the Enclave-WebApp Enclave Endpoints.

   

Create a community endpoint

1. Go to the cmt-fabrikam community, select Community Endpoints, and then select Create.

   

2. Enter the community endpoint name and then select Next:

   • Community endpoint name: ce-fabrikam-website

3. Enter the endpoint rules for your app:

   • Select + Add to add Endpoint Rules that represent how to access your app
     • Rule Name: Website-Rule
     • Destination Type: FQDN
     • Destination: *.microsoft.com
     • Protocol: HTTPS
     • Port: 443

   

4. Select Save, select Review + Create, and select Create.

5. After the portal creates the endpoint resource, you can view it in the Azure portal from the Enclave-WebApp enclave endpoint page.

   

Create an enclave connection

Create an enclave connection from the web app enclave to the community endpoint so the app can reach required site outside the community.

1. From the cmt-fabrikam community, select Enclave Connections, then select Create.

   

2. Enter the details for your app/service

   • Resource Group: myResourceGroup
   • Enclave connection name: Name of the connection ec-fabrikam-external-connection
   • Community: Select cmt-fabrikam from the dropdown
   • Source Type: Select Enclave
   • Source enclave: Select ve-Enclave-WebApp from the dropdown
   • Source IP addresses/CIDR range(s): <See the information box that gives your enclave subnet range (for example 10.0.2.0/26) and make sure there are no commas at the end>
   • Destination Endpoint Type: Select Community Endpoint
   • Destination endpoint: Select ce-fabrikam-website from the dropdown

   

3. Select Review + Create and then Create

   

4. After the portal creates the endpoint resource, you can view it in the Azure portal from the cmt-fabrikam Enclave Connections. However, it's in a disconnected state because the community requires approvals on all new enclave connections and updates to those connections.

   

5. Review the pending approvals in Approvals on the left for the enclave.

   

6. Approve the pending approvals and the connection state is automatically updated to the connected state. For more information about reviewing approval requests, see Manage approval requests. For resource-type approval settings, see Configure approval settings.

Clean up resources

If you no longer need the endpoint and connection resources that you created in this tutorial, delete them to avoid incurring unnecessary charges.

Warning

Deleting endpoint and connection resources is permanent and can't be undone. Review dependent workloads and active traffic paths before deletion.

Before deleting:

• Verify that no workloads depend on these endpoints or connections.

Recommended deletion order:

1. Delete enclave connections.
2. Delete enclave endpoints.
3. Delete community endpoints.

To delete enclave connections:

1. In the Azure portal, go to your community (for example, cmt-fabrikam).
2. Select Enclave Connections.
3. Select the enclave connection to delete (for example, ec-fabrikam-external-connection).
4. Select Delete.
5. Confirm deletion.

To delete enclave endpoints:

1. In the Azure portal, go to the source enclave (for example, ve-Enclave-WebApp).
2. Select Enclave Endpoints.
3. Select the enclave endpoint to delete (for example, ee-MyService).
4. Select Delete.
5. Confirm deletion.

To delete community endpoints:

1. In the Azure portal, go to your community (for example, cmt-fabrikam).
2. Select Community Endpoints.
3. Select the community endpoint to delete (for example, ce-fabrikam-website).
4. Select Delete.
5. Confirm deletion.

What gets deleted:

• Enclave connection resources that you created in this tutorial.
• Enclave endpoint resources that you created in this tutorial.
• Community endpoint resources that you created in this tutorial.

What is retained:

• Community and enclave resources.
• Workloads and subnet resources.
• Approval settings and other unrelated Azure Enclave resources.

Next steps

In this tutorial, you deployed community and enclave endpoints using Azure portal. You also learned how to:

• Create connections

In the next tutorial, you'll learn how to create connections using these endpoints.