Private Endpoints and Egress¶
Two rules protect data in transit. Inbound: PaaS services holding data (storage, Key Vault, databases) are reached over private endpoints, not the public internet. Outbound: workloads reach the internet through a controlled path, so data can't leave by any route.
Status: planned
The network guardrail policies (psa-net-Baseline, psa-st-Network) are assigned in audit mode. No private endpoints or firewall exist yet.
Private endpoints¶
| Service type | Standard for production |
|---|---|
| Storage accounts (including Terraform state) | Private endpoint, public network access disabled |
| Key Vault | Private endpoint, public network access disabled |
| Databases (SQL, PostgreSQL, Cosmos DB) | Private endpoint, public network access disabled |
| Web front ends meant for the public | Public, behind Front Door or Application Gateway with a web application firewall |
| Sandboxes | Public allowed, but never holding real data |
Things to know¶
- Private DNS is required. Without the central
privatelinkzones, a private endpoint resolves to its public address and the connection fails or goes the wrong way. See DNS. - CI runners must reach private endpoints too. Once state storage and Key Vault are private, GitLab runners need a network path to them, such as self-hosted runners in a VNet. Shared GitLab runners won't reach them. Plan for this before disabling public access on state storage.
- Policy guardrails: audit first, then deny public network access by service, following the ADR-0001 promotion path.
Egress¶
| Standard | Detail |
|---|---|
| Default route to the firewall | Every spoke subnet sends 0.0.0.0/0 to the hub firewall |
| Allow list, not block list | The firewall allows known destinations (FQDN rules for package mirrors and APIs). Everything else is denied and logged. |
| No public IPs on workload VMs | Admin access through Azure Bastion. Outbound through the firewall. |
| Firewall logs to the central workspace | Evidence for investigations, and a way to see what workloads actually need |
| Default outbound access disabled on subnets | Azure is retiring implicit outbound internet access for new VNets, so set defaultOutboundAccess = false and route explicitly |
Until a hub exists, workloads on public PaaS services have no egress to control. Revisit this page when the first VNet-connected workload arrives.