MySQL and PostgreSQL gets VNet Service Endpoints

Recently Microsoft has released Azure database services for MySQL and PostgreSQL.

What’s it offers?

These include the high availability of the community versions of MySQL and PostgreSQL (99.99%) and also include elastic scaling for performance, and industry-leading security and compliance on Azure.
And as a part of the service Microsoft has introduced new features and capabilities such as increased storage and availability across more regions worldwide.

Now they have announced the general availability of Virtual Network (VNet) service endpoints for Azure Database for MySQL and PostgreSQL in all regions where the service is available for General Purpose and Memory Optimized servers.

You can check the service availability by visiting region expansion for MySQL and PostgreSQL.

Why VNet Endpoints?

To isolate connectivity to your logical server from only a given subnet or set of subnets within your virtual network, VNet Endpoints are the best. The Database traffic for MySQL and/or PostgreSQL from your VNet always stays within the Azure backbone network. According to this, direct route is over any specific ones that route Internet traffic through virtual appliances or on-premises.

Since it’s a free service you can use it very easily.

Allowing access to VNet service endpoints using firewall rules.

Once you configured the VNet points you have to give firewall rules to grant permission for access. It doesn’t support or allow access by default. It does not endpoints does not override firewall rules that you have provisioned on your Azure Database for MySQL or PostgreSQL. Both continue to be applicable.

VNet service endpoints don’t extend to on-premises. To allow access from on-premises, firewall rules can be used to limit connectivity only to your public (NAT) IPs.

There are some articles to learn how to enable VNet protection.Visit these articles for Azure Database for MySQL and PostgreSQL.

Using pre-existing firewall rules to Turn on service endpoints for servers

Once you turn on the service endpoints and connect to the server, database connection’s the source IP will switch to the private IP space of your VNet. Configuration will have done by via “Microsoft.Sql” shared service tag for all Azure Databases including Azure Database for MySQL, PostgreSQL, Azure SQL Database Managed Instance, and Azure SQL Data Warehouse.

Whenever your server or database firewall rules allow specific Azure public IPs, the connectivity will be broken until it gets the VNet/subnet by specifying it in the VNet firewall rules. To ensure connectivity, you can preemptively specify VNet firewall rules before turning on service endpoints by using IgnoreMissingServiceEndpoint flag.