快速入門：使用 ARM 範本建立私人連結服務

發行項
2024/12/04

在本快速入門中，您將使用 Azure Resource Manager 範本 (ARM 範本) 來建立私人連結服務。

Azure Resource Manager 範本是一個 JavaScript 物件標記法 (JSON) 檔案，會定義專案的基礎結構和設定。範本使用宣告式語法。您可以描述預期的部署，而不需要撰寫程式設計命令順序來建立部署。

您也可以使用 Azure 入口網站、Azure PowerShell 或 Azure CLI 來完成本快速入門。

如果您的環境符合必要條件，而且您很熟悉 ARM 範本，請選取 [部署至 Azure] 按鈕。範本會在 Azure 入口網站中開啟。

必要條件

您需要具有有效訂用帳戶的 Azure 帳戶。免費建立帳戶。

檢閱範本

此範本會建立私人連結服務。

本快速入門中使用的範本是來自 Azure 快速入門範本。

JSON

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.5.6.12127",
      "templateHash": "4187161334981532249"
    }
  },
  "parameters": {
    "vmAdminUsername": {
      "type": "string",
      "metadata": {
        "description": "Username for the Virtual Machine."
      }
    },
    "vmAdminPassword": {
      "type": "secureString",
      "metadata": {
        "description": "Password for the Virtual Machine. The password must be at least 12 characters long and have lower case, upper characters, digit and a special character (Regex match)"
      }
    },
    "vmSize": {
      "type": "string",
      "defaultValue": "Standard_D2_v3",
      "metadata": {
        "description": "The size of the VM"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "variables": {
    "vnetName": "myVirtualNetwork",
    "vnetConsumerName": "myPEVnet",
    "vnetAddressPrefix": "10.0.0.0/16",
    "frontendSubnetPrefix": "10.0.1.0/24",
    "frontendSubnetName": "frontendSubnet",
    "backendSubnetPrefix": "10.0.2.0/24",
    "backendSubnetName": "backendSubnet",
    "consumerSubnetPrefix": "10.0.0.0/24",
    "consumerSubnetName": "myPESubnet",
    "loadbalancerName": "myILB",
    "backendPoolName": "myBackEndPool",
    "loadBalancerFrontEndIpConfigurationName": "myFrontEnd",
    "healthProbeName": "myHealthProbe",
    "privateEndpointName": "myPrivateEndpoint",
    "vmName": "[take(format('myVm{0}', uniqueString(resourceGroup().id)), 15)]",
    "networkInterfaceName": "[format('{0}NetInt', variables('vmName'))]",
    "vmConsumerName": "[take(format('myConsumerVm{0}', uniqueString(resourceGroup().id)), 15)]",
    "publicIpAddressConsumerName": "[format('{0}PublicIP', variables('vmConsumerName'))]",
    "networkInterfaceConsumerName": "[format('{0}NetInt', variables('vmConsumerName'))]",
    "osDiskType": "StandardSSD_LRS",
    "privatelinkServiceName": "myPLS",
    "loadbalancerId": "[resourceId('Microsoft.Network/loadBalancers', variables('loadbalancerName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2021-05-01",
      "name": "[variables('vnetName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[variables('frontendSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('frontendSubnetPrefix')]",
              "privateLinkServiceNetworkPolicies": "Disabled"
            }
          },
          {
            "name": "[variables('backendSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('backendSubnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/loadBalancers",
      "apiVersion": "2021-05-01",
      "name": "[variables('loadbalancerName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "properties": {
        "frontendIPConfigurations": [
          {
            "name": "[variables('loadBalancerFrontEndIpConfigurationName')]",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "subnet": {
                "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('frontendSubnetName'))]"
              }
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "[variables('backendPoolName')]"
          }
        ],
        "inboundNatRules": [
          {
            "name": "RDP-VM0",
            "properties": {
              "frontendIPConfiguration": {
                "id": "[resourceId('Microsoft.Network/loadBalancers/frontendIpConfigurations', variables('loadbalancerName'), variables('loadBalancerFrontEndIpConfigurationName'))]"
              },
              "protocol": "Tcp",
              "frontendPort": 3389,
              "backendPort": 3389,
              "enableFloatingIP": false
            }
          }
        ],
        "loadBalancingRules": [
          {
            "name": "myHTTPRule",
            "properties": {
              "frontendIPConfiguration": {
                "id": "[resourceId('Microsoft.Network/loadBalancers/frontendIpConfigurations', variables('loadbalancerName'), variables('loadBalancerFrontEndIpConfigurationName'))]"
              },
              "backendAddressPool": {
                "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('loadbalancerName'), variables('backendPoolName'))]"
              },
              "probe": {
                "id": "[resourceId('Microsoft.Network/loadBalancers/probes', variables('loadbalancerName'), variables('healthProbeName'))]"
              },
              "protocol": "Tcp",
              "frontendPort": 80,
              "backendPort": 80,
              "idleTimeoutInMinutes": 15
            }
          }
        ],
        "probes": [
          {
            "properties": {
              "protocol": "Tcp",
              "port": 80,
              "intervalInSeconds": 15,
              "numberOfProbes": 2
            },
            "name": "[variables('healthProbeName')]"
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2021-05-01",
      "name": "[variables('networkInterfaceName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[variables('networkInterfaceName')]"
      },
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipConfig1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "subnet": {
                "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('backendSubnetName'))]"
              },
              "loadBalancerBackendAddressPools": [
                {
                  "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('loadbalancerName'), variables('backendPoolName'))]"
                }
              ],
              "loadBalancerInboundNatRules": [
                {
                  "id": "[resourceId('Microsoft.Network/loadBalancers/inboundNatRules/', variables('loadbalancerName'), 'RDP-VM0')]"
                }
              ]
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/loadBalancers', variables('loadbalancerName'))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2021-11-01",
      "name": "[variables('vmName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[variables('vmName')]"
      },
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('vmSize')]"
        },
        "osProfile": {
          "computerName": "[variables('vmName')]",
          "adminUsername": "[parameters('vmAdminUsername')]",
          "adminPassword": "[parameters('vmAdminPassword')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2019-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "name": "[format('{0}OsDisk', variables('vmName'))]",
            "caching": "ReadWrite",
            "createOption": "FromImage",
            "managedDisk": {
              "storageAccountType": "[variables('osDiskType')]"
            },
            "diskSizeGB": 128
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "apiVersion": "2021-11-01",
      "name": "[format('{0}/{1}', variables('vmName'), 'installcustomscript')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "install software for Windows VM"
      },
      "properties": {
        "publisher": "Microsoft.Compute",
        "type": "CustomScriptExtension",
        "typeHandlerVersion": "1.9",
        "autoUpgradeMinorVersion": true,
        "protectedSettings": {
          "commandToExecute": "powershell -ExecutionPolicy Unrestricted Install-WindowsFeature -Name Web-Server"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/privateLinkServices",
      "apiVersion": "2021-05-01",
      "name": "[variables('privatelinkServiceName')]",
      "location": "[parameters('location')]",
      "properties": {
        "enableProxyProtocol": false,
        "loadBalancerFrontendIpConfigurations": [
          {
            "id": "[resourceId('Microsoft.Network/loadBalancers/frontendIpConfigurations', variables('loadbalancerName'), variables('loadBalancerFrontEndIpConfigurationName'))]"
          }
        ],
        "ipConfigurations": [
          {
            "name": "snet-provider-default-1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "privateIPAddressVersion": "IPv4",
              "subnet": {
                "id": "[reference(variables('loadbalancerId'), '2019-06-01').frontendIPConfigurations[0].properties.subnet.id]"
              },
              "primary": false
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/loadBalancers', variables('loadbalancerName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2021-05-01",
      "name": "[variables('vnetConsumerName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[variables('vnetAddressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "[variables('consumerSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('consumerSubnetPrefix')]",
              "privateEndpointNetworkPolicies": "Disabled"
            }
          },
          {
            "name": "[variables('backendSubnetName')]",
            "properties": {
              "addressPrefix": "[variables('backendSubnetPrefix')]"
            }
          }
        ]
      }
    },
    {
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2021-05-01",
      "name": "[variables('publicIpAddressConsumerName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[variables('publicIpAddressConsumerName')]"
      },
      "properties": {
        "publicIPAllocationMethod": "Dynamic",
        "dnsSettings": {
          "domainNameLabel": "[toLower(variables('vmConsumerName'))]"
        }
      }
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2021-05-01",
      "name": "[variables('networkInterfaceConsumerName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[variables('networkInterfaceConsumerName')]"
      },
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipConfig1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "publicIPAddress": {
                "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressConsumerName'))]"
              },
              "subnet": {
                "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetConsumerName'), variables('consumerSubnetName'))]"
              }
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressConsumerName'))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetConsumerName'))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2021-11-01",
      "name": "[variables('vmConsumerName')]",
      "location": "[parameters('location')]",
      "tags": {
        "displayName": "[variables('vmConsumerName')]"
      },
      "properties": {
        "hardwareProfile": {
          "vmSize": "[parameters('vmSize')]"
        },
        "osProfile": {
          "computerName": "[variables('vmConsumerName')]",
          "adminUsername": "[parameters('vmAdminUsername')]",
          "adminPassword": "[parameters('vmAdminPassword')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2019-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "name": "[format('{0}OsDisk', variables('vmConsumerName'))]",
            "caching": "ReadWrite",
            "createOption": "FromImage",
            "managedDisk": {
              "storageAccountType": "[variables('osDiskType')]"
            },
            "diskSizeGB": 128
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceConsumerName'))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceConsumerName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/privateEndpoints",
      "apiVersion": "2021-05-01",
      "name": "[variables('privateEndpointName')]",
      "location": "[parameters('location')]",
      "properties": {
        "subnet": {
          "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetConsumerName'), variables('consumerSubnetName'))]"
        },
        "privateLinkServiceConnections": [
          {
            "name": "[variables('privateEndpointName')]",
            "properties": {
              "privateLinkServiceId": "[resourceId('Microsoft.Network/privateLinkServices', variables('privatelinkServiceName'))]"
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/privateLinkServices', variables('privatelinkServiceName'))]",
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetConsumerName'))]"
      ]
    }
  ]
}

範本中定義了多個 Azure 資源：

Microsoft.Network/virtualNetworks：每部虛擬機器都有一個虛擬網路。
Microsoft.Network/loadBalancers：此負載平衡器會公開裝載服務的虛擬機器。
Microsoft.Network/networkInterfaces：網路介面有兩個，每部虛擬機器各一個。
Microsoft.Compute/virtualMachines：虛擬機器有兩部，一部會裝載服務，一部會測試與私人端點的連線。
Microsoft.Compute/virtualMachines/extensions：安裝網頁伺服器的延伸模組。
Microsoft.Network/privateLinkServices：公開服務的私人連結服務。
Microsoft.Network/publicIpAddresses：公用 IP 位址有兩個，每部虛擬機器各一個。
Microsoft.Network/privateendpoints：用來存取服務的私人端點。

部署範本

以下說明如何將 ARM 範本部署至 Azure：

若要登入 Azure 並開啟範本，請選取 [部署至 Azure]。此範本會建立虛擬機器、標準負載平衡器、私人連結服務、私人端點、網路，以及要驗證的虛擬機器。
選取或建立資源群組。
輸入虛擬機器管理員的使用者名稱和密碼。
選取 [檢閱 + 建立]。
選取建立。

部署需要數分鐘的時間才能完成。

驗證部署

注意

ARM 範本會為虛擬機器 myConsumerVm{uniqueid} 資源產生唯一的名稱。請以您產生的值替代 {uniqueid}。

從網際網路連線至 VM

從網際網路連線至 VM myConsumerVm{uniqueid}，如下所示：

在入口網站的搜尋列中，輸入 myConsumerVm{uniqueid}。
選取 Connect。 [連線至虛擬機器] 隨即開啟。
選取 [下載 RDP 檔案]。 Azure 會建立一個「遠端桌面通訊協定」(.rdp) 檔案，並下載至您的電腦。
開啟下載到電腦的 RDP 檔案。

a. 如果出現提示，請選取 [連接]。

b. 輸入您在建立 VM 時所指定的使用者名稱和密碼。

注意

您可能需要選取 [其他選擇]>[使用不同的帳戶]，以指定您在建立 VM 時輸入的認證。
選取 [確定]。
您可能會在登入過程中收到憑證警告。如果您收到憑證警告，請選取 [是] 或 [繼續]。
在 VM 桌面出現之後，將其最小化以回到您的本機桌面。

從 VM 私下存取 HTTP 服務

以下是使用私人端點從 VM 連線到 HTTP 服務的方法。

移至 myConsumerVm{uniqueid} 的遠端桌面。
開啟瀏覽器，然後輸入私人端點位址：http://10.0.0.5/。
預設的 IIS 頁面隨即出現。

清除資源

當您不再需要先前為私人連結服務建立的資源時，請刪除資源群組。此作業會移除私人連結服務和所有相關資源。

呼叫 Remove-AzResourceGroup Cmdlet 以刪除資源群組：

Azure PowerShell

Remove-AzResourceGroup -Name <your resource group name>

下一步

若要深入了解可支援私人端點的服務，請參閱：

Private Link 可用性

共用方式為