共用方式為

Create and manage Private Link for Azure Database for PostgreSQL - Single server using Portal

  • 發行項

APPLIES TO: Azure Database for PostgreSQL - Single Server

Important

Azure Database for PostgreSQL - Single Server is on the retirement path. We strongly recommend that you upgrade to Azure Database for PostgreSQL - Flexible Server. For more information about migrating to Azure Database for PostgreSQL - Flexible Server, see What's happening to Azure Database for PostgreSQL Single Server?.

A Private Endpoint is the fundamental building block for private link in Azure. It enables Azure resources, like Virtual Machines (VMs), to communicate privately with private link resources. In this article, you will learn how to use the Azure portal to create a VM in an Azure Virtual Network and an Azure Database for PostgreSQL Single server with an Azure private endpoint.

If you don't have an Azure subscription, create a free account before you begin.

Note

The private link feature is only available for Azure Database for PostgreSQL servers in the General Purpose or Memory Optimized pricing tiers. Ensure the database server is in one of these pricing tiers.

Sign in to Azure

Sign in to the Azure portal.

Create an Azure VM

In this section, you will create virtual network and the subnet to host the VM that is used to access your Private Link resource (a PostgreSQL server in Azure).

Create the virtual network

In this section, you will create a Virtual Network and the subnet to host the VM that is used to access your Private Link resource.

  1. On the upper-left side of the screen, select Create a resource > Networking > Virtual network.

  2. In Create virtual network, enter or select this information:

    Setting Value
    Name Enter MyVirtualNetwork.
    Address space Enter 10.1.0.0/16.
    Subscription Select your subscription.
    Resource group Select Create new, enter myResourceGroup, then select OK.
    Location Select West Europe.
    Subnet - Name Enter mySubnet.
    Subnet - Address range Enter 10.1.0.0/24.

  3. Leave the rest as default and select Create.

Create Virtual Machine

  1. On the upper-left side of the screen in the Azure portal, select Create a resource > Compute > Virtual Machine.

  2. In Create a virtual machine - Basics, enter or select this information:

    Setting Value
    PROJECT DETAILS
    Subscription Select your subscription.
    Resource group Select myResourceGroup. You created this in the previous section.
    INSTANCE DETAILS
    Virtual machine name Enter myVm.
    Region Select West Europe.
    Availability options Leave the default No infrastructure redundancy required.
    Image Select Windows Server 2019 Datacenter.
    Size Leave the default Standard DS1 v2.
    ADMINISTRATOR ACCOUNT
    Username Enter a username of your choosing.
    Password Enter a password of your choosing. The password must be at least 12 characters long and meet the defined complexity requirements.
    Confirm Password Reenter password.
    INBOUND PORT RULES
    Public inbound ports Leave the default None.
    SAVE MONEY
    Already have a Windows license? Leave the default No.

  3. Select Next: Disks.

  4. In Create a virtual machine - Disks, leave the defaults and select Next: Networking.

  5. In Create a virtual machine - Networking, select this information:

    Setting Value
    Virtual network Leave the default MyVirtualNetwork.
    Address space Leave the default 10.1.0.0/24.
    Subnet Leave the default mySubnet (10.1.0.0/24).
    Public IP Leave the default (new) myVm-ip.
    Public inbound ports Select Allow selected ports.
    Select inbound ports Select HTTP and RDP.

  6. Select Review + create. You're taken to the Review + create page where Azure validates your configuration.

  7. When you see the Validation passed message, select Create.

Note

In some cases the Azure Database for PostgreSQL and the VNet-subnet are in different subscriptions. In these cases you must ensure the following configurations:

  • Make sure that both the subscription has the Microsoft.DBforPostgreSQL resource provider registered. For more information refer resource-manager-registration

Create an Azure Database for PostgreSQL Single server

In this section, you will create an Azure Database for PostgreSQL server in Azure.

  1. On the upper-left side of the screen in the Azure portal, select Create a resource > Databases > Azure Database for PostgreSQL.

  2. In Azure Database for PostgreSQL deployment option, select Single server and provide these information:

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select myResourceGroup. You created this in the previous section.
    Server details
    Server name Enter myserver. If this name is taken, create a unique name.
    Admin username Enter an administrator name of your choosing.
    Password Enter a password of your choosing. The password must be at least 8 characters long and meet the defined requirements.
    Location Select an Azure region where you want to want your PostgreSQL Server to reside.
    Version Select the database version of the PostgreSQL server that is required.
    Compute + Storage Select the pricing tier that is needed for the server based on the workload.

  3. Select OK.

  4. Select Review + create. You're taken to the Review + create page where Azure validates your configuration.

  5. When you see the Validation passed message, select Create.

  6. When you see the Validation passed message, select Create.

Create a private endpoint

In this section, you will create a PostgreSQL server and add a private endpoint to it.

  1. On the upper-left side of the screen in the Azure portal, select Create a resource > Networking > Private Link.

  2. In Private Link Center - Overview, on the option to Build a private connection to a service, select Start.

    Private Link overview

  3. In Create a private endpoint - Basics, enter or select this information:

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select myResourceGroup. You created this in the previous section.
    Instance Details
    Name Enter myPrivateEndpoint. If this name is taken, create a unique name.
    Region Select West Europe.

  4. Select Next: Resource.

  5. In Create a private endpoint - Resource, enter or select this information:

    Setting Value
    Connection method Select connect to an Azure resource in my directory.
    Subscription Select your subscription.
    Resource type Select Microsoft.DBforPostgreSQL/servers.
    Resource Select myServer
    Target sub-resource Select postgresqlServer

  6. Select Next: Configuration.

  7. In Create a private endpoint - Configuration, enter or select this information:

    Setting Value
    NETWORKING
    Virtual network Select MyVirtualNetwork.
    Subnet Select mySubnet.
    PRIVATE DNS INTEGRATION
    Integrate with private DNS zone Select Yes.
    Private DNS Zone Select (New)privatelink.postgres.database.azure.com

    Note

    Use the predefined private DNS zone for your service or provide your preferred DNS zone name. Refer to the Azure services DNS zone configuration for details.

  8. Select Review + create. You're taken to the Review + create page where Azure validates your configuration.

  9. When you see the Validation passed message, select Create.

    Private Link created

    Note

    The FQDN in the customer DNS setting does not resolve to the private IP configured. You will have to setup a DNS zone for the configured FQDN as shown here.

Connect to a VM using Remote Desktop (RDP)

After you've created myVm, connect to it from the internet as follows:

  1. In the portal's search bar, enter myVm.

  2. Select the Connect button. After selecting the Connect button, Connect to virtual machine opens.

  3. Select Download RDP File. Azure creates a Remote Desktop Protocol (.rdp) file and downloads it to your computer.

  4. Open the downloaded.rdp file.

    1. If prompted, select Connect.

    2. Enter the username and password you specified when creating the VM.

      Note

      You may need to select More choices > Use a different account, to specify the credentials you entered when you created the VM.

  5. Select OK.

  6. You may receive a certificate warning during the sign-in process. If you receive a certificate warning, select Yes or Continue.

  7. Once the VM desktop appears, minimize it to go back to your local desktop.

Access the PostgreSQL server privately from the VM

  1. In the Remote Desktop of myVM, open PowerShell.

  2. Enter nslookup mydemopostgresserver.privatelink.postgres.database.azure.com.

    You'll receive a message similar to this:

    Server:  UnKnown
Address:  168.63.129.16
Non-authoritative answer:
Name:    mydemopostgresserver.privatelink.postgres.database.azure.com
Address:  10.1.3.4

  3. Test the private link connection for the PostgreSQL server using any available client. In the example below I have used Azure Data studio to do the operation.

  4. In New connection, enter or select this information:

    Setting Value
    Server type Select PostgreSQL.
    Server name Select mydemopostgresserver.privatelink.postgres.database.azure.com
    User name Enter username as username@servername which is provided during the PostgreSQL server creation.
    Password Enter a password provided during the PostgreSQL server creation.
    SSL Select Required.

  5. Select Connect.

  6. Browse databases from left menu.

  7. (Optionally) Create or query information from the postgreSQL server.

  8. Close the remote desktop connection to myVm.

Clean up resources

When you're done using the private endpoint, PostgreSQL server, and the VM, delete the resource group and all of the resources it contains:

  1. Enter myResourceGroup in the Search box at the top of the portal and select myResourceGroup from the search results.
  2. Select Delete resource group.
  3. Enter myResourceGroup for TYPE THE RESOURCE GROUP NAME and select Delete.

Next steps

In this how-to, you created a VM on a virtual network, an Azure Database for PostgreSQL - Single server, and a private endpoint for private access. You connected to one VM from the internet and securely communicated to the PostgreSQL server using Private Link. To learn more about private endpoints, see What is Azure private endpoint.