>> Hi. On this episode of Data Exposed,
we'll be covering Private Link,
which recently went GA for Azure SQL Database.
Be sure to tune in to learn more on Data Exposed.
[MUSIC]
>> Hi, welcome to this episode of Data Exposed.
Today, we're going to be talking about
Private Link for Azure SQL Database.
Today, have joined with me from his home, Rohit Nayak,
who is a PM on the Azure SQL team.
Thanks for joining us, Rohit.
>> Thank you, Anna.
>> Today, you're going to be telling us a
little bit more about Private Link,
which I think went GA recently.
Can you tell us more about what it is?
>> Absolutely. So let me share my screen here and bring
up our deck and then go from there.
We have been doing a series of videos in the past,
and we have taken customers through
the connectivity architecture of SQL Database.
This slide should look familiar to customers if
they reviewed the playlist of the videos that we put together.
This is the story for how you connect to
SQL Database today through what we call as a public endpoint.
When I say public endpoint,
I mean that your connectivity comes
in through SQL gateway in the region,
and then you get redirected to the backend.
So hopefully, this is some context that listeners will have.
If not, then they can go review the previous videos.
So now, let me tell you what's new.
So we deal with a feature called Private Link,
and all this does is give you private connectivity
to your Platform as a Service in Azure,
and you can connect to
the PaaS service from within your virtual network.
So I know there's a lot of technical terms here,
so let me simplify it with a picture.
So imagine you have a SQL Database
running in Azure today and you have
an Azure virtual machine which has
this private IP address of ending in 1.5.
Typically, Azure virtual machines are
deployed in the context of virtual network.
So what the Private Link concept
is all about is taking another IP address
in this VNet and then linking it to the SQL Database.
This comes with several key benefits.
Number 1 is you have
one single private endpoint for your logical server.
Since there's a server level entity,
it allows you private connectivity
to everything underneath that server,
which could be a SQL Database,
a Synapse workspace, elastic pools, or Hyperscale database.
The big value prop here is
your connection string remains unchanged.
So if you have legacy apps that connect to SQL Database,
nothing needs to be changed from the hub site.
The third big value add is you can now connect
to SQL Database from on-premises via ExpressRoute or VPN.
Because as long as you can get to this IP address,
you have a private connection to SQL Database.
>> Rohit, when you say private connection,
does that mean that it's a more secure connection?
Can you explain to us why we brought this feature about?
>> Absolutely. So one of the feedbacks
we heard from customers is in the previous model,
the picture that I showed you,
you have the SQL gateway which is
the common control plane across all SQL Databases in a region.
So customers were concerned about data exfiltration,
and the fact that you have
this one common control plane that is multi-tenant.
So in this particular feature,
what happens is you always end up connecting to
this private endpoint which is a fixed IP address,
and that is how your risks
for data exfiltration via the login part goes down.
So absolutely by introducing
one of the reasons for this feature is
to increase the security of the connections to SQL Database.
>> I see. Got it, thanks.
>> As you mentioned, we are here for SQL Database, Storage,
and many more services are coming
or have landed actually since the GA.
So now that we introduced the concept,
let me go next to,
how does this actually work?
So when you look at private endpoints,
so private endpoint is actually an ARM resource that gets
deployed in the portal when you create this.
Think of it like a wrapper around a private IP address.
But it consists of three major things for it to work.
Number 1, you need to know what
is your Private Link resource which is,
what is the PaaS service that you want to connect to privately?
So in our case, it could be a storage account,
it could be Azure SQL Database,
or any of the other ones that are coming up.
Number 2, you need the networking piece which is,
where does this private endpoint going to be hosted?
Which virtual network and subnet?
So you need to think about that ahead of time and learn it out.
Third is, when I make a database call to my server.database.
windows.net, that needs to be
captured and then routed to the private endpoint.
So that is being done by
this third component called the private DNS zone,
and we'll see that in our next session where we demo this.
But this is the key thing that
ensures that you don't need to change your connection string,
that you connect to SQL Database as you
do today and the DNS zone takes care
of ensuring that that
traffic goes via the private route using the private endpoint.
So this was what private endpoint is all about,
and then let me conclude by
just bringing it home with the different connectivity scenarios.
So this is actually how we see customers using this in practice.
So to begin with,
you start with the private endpoint which is in a VNet in Azure.
To keep it simple here, I'm assuming you want to
connect from an Azure VM as your client.
So you could definitely connect with client in the same VNet
and subnet because that's by default allowed by Azure.
The more interesting scenarios is
when you can do something called as VNet Peering,
where you have two virtual networks
within your subscription and you
enable this VNet Peering feature on
the networking side so traffic can flow between them,
and then you can have a client in
the peered VNet communicates to the private endpoint.
Then the third common scenario is how to connect from on-premises.
So to be able to do this,
you need something called as a VNet Gateway
which enables that connectivity from on-premises.
Then there are various options like point-to-site,
site-to-site VPN, or ExpressRoute.
Finally, the fourth interesting scenario which customers use a lot
is I have my SQL Databases in East US and my client is in West Us.
How do these talk to each other?
This is a common scenario,
where you use this VNet-to-VNet connection type
supported by Azure networking
and you need VNet Gateways on both ends,
but then the connectivity happens to Private Link this way.
So that was a high-level overview of
the feature and how we see customers will use it.
In the next session, I'll show you
an end-to-end demo of how this works.
>> Thanks, Rohit. Thanks for joining us
and sharing that information about Private Link.
It seems like a great new way to get some of
the Private Link capabilities that are
built into Managed Instance from Azure SQL Database.
For our listeners, be sure to tune in
next time where Rohit actually goes through what this
looks like in the portal and shows
us some of the connectivity behind the scenes.
>> Absolutely, Anna.
It was a pleasure to be here,
and stay with us as
we go into the next video that we show you a demo.
>> Awesome, thanks. If you like this video,
please like the video,
leave us a comment, and subscribe to our channel.
Thanks, see you next time on Data Exposed.
[MUSIC]