Private Link Nic creation

[kevball2]

Hi all,

I am deploying private links as part of a cosmoDB deployment. I am trying to enable diagnostics for all the azure resources as they are being deployed. When the private link is created, a NIC is generated on the subnet I am targeting. It does not appear there is a way to control this NIC creation, so I am not able to setup diagnostic for that NIC in my bicep file.

I am wondering if this is even possible with templates or if it maybe easier to configure with Azure Policy

[brwilkinson]

I can relate to this question; however I don't have an answer straight out.

I have always wondered the same thing.

I think it should be easy enough to create an existing resource reference for the NIC and then enable the logging, I will give it a try...

[brwilkinson]

Here are a few examples or resource templates that call that private endpoint template.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.appService.bicep
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/SA-Storage.bicep

At the end of each there are 2 modules.

One that calls the private endpoint and the other that sets the private DNS for the endpoint.

module vnetPrivateLink 'x.vNetPrivateLink.bicep' = if (contains(storageInfo, 'privatelinkinfo')) {
  name: 'dp${Deployment}-SA-privatelinkloop-${storageInfo.name}'
  params: {
    Deployment: Deployment
    DeploymentURI: DeploymentURI
    PrivateLinkInfo: storageInfo.privateLinkInfo
    providerType: SA.type
    resourceName: SA.name
  }
}



module privateLinkDNS 'x.vNetprivateLinkDNS.bicep' = if (contains(storageInfo, 'privatelinkinfo')) {
  name: 'dp${Deployment}-SA-registerPrivateDNS-${storageInfo.name}'
  scope: resourceGroup(HubRGName)
  params: {
    PrivateLinkInfo: storageInfo.privateLinkInfo
    providerURL: '${environment().suffixes.storage}' // '.core.windows.net'
    providerType: SA.type
    resourceName: SA.name
    Nics: contains(storageInfo, 'privatelinkinfo') && length(storageInfo) != 0 ? array(vnetPrivateLink.outputs.NICID) : array('')
  }
}

So the setup of the NIC diags occurs in x.vNetPrivateLink.bicep only if private link is enabled on the resource.

[brwilkinson]

[kevball2]

Thanks for the detailed info @brwilkinson, I was using the wrong Id for the NIC scope, was trying to pass in privateEndpoint.properties.networkInterfaces[0].name for the scope of the diagnostic. Bicep would complain that this was something that didn't exist yet. You method of getting the NIC id and getting the existing to use for the scope was what I needed to get mine working as well.

ps love the work you have done of ADF, Hoping I'll have a large enough customer I can implement it with at some point!

[brwilkinson]

right i think in all of this, the following is what enables the whole thing to work 🙂

last(split(subnetPrivateEndpoint[index].properties.networkInterfaces[0].id,'/'))

[brwilkinson]

on the ADF thing. I realize it's hard to onboard that project, without having someone explain how it all works. I know at the moment, it's been useful for people to grab code snippets and examples. I am working to be able to simply explain how to use the tooling that comes with it, however that is a work in progress as I also slowly update the docs etc. I think it would need some videos to really enable people (who are not my own customers) to onboard it.

[kevball2]

Thanks for all the info @brwilkinson, the snippets you provided helped solve my deployment issue. looking forward to seeing some updated documentation on ADF.