Create and manage VNet service endpoints for Azure Database for PostgreSQL - Single Server using Azure CLI
Virtual Network (VNet) services endpoints and rules extend the private address space of a Virtual Network to your Azure Database for PostgreSQL server. Using convenient Azure Command Line Interface (CLI) commands, you can create, update, delete, list, and show VNet service endpoints and rules to manage your server. For an overview of Azure Database for PostgreSQL VNet service endpoints, including limitations, see Azure Database for PostgreSQL Server VNet service endpoints. VNet service endpoints are available in all supported regions for Azure Database for PostgreSQL.
To step through this how-to guide, you need:
- Install the Azure CLI or use the Azure Cloud Shell in the browser.
- An Azure Database for PostgreSQL server and database.
Support for VNet service endpoints is only for General Purpose and Memory Optimized servers. In case of VNet peering, if traffic is flowing through a common VNet Gateway with service endpoints and is supposed to flow to the peer, please create an ACL/VNet rule to allow Azure Virtual Machines in the Gateway VNet to access the Azure Database for PostgreSQL server.
Configure Vnet service endpoints for Azure Database for PostgreSQL
The az network vnet commands are used to configure Virtual Networks.
If you don't have an Azure subscription, create a free account before you begin.
Open Azure Cloud Shell
Azure Cloud Shell is an interactive shell environment hosted in Azure and used through your browse. Azure Cloud Shell allows you to
PowerShell shells to run a variety of tools to work with Azure services. Azure Cloud Shell comes pre-installed with the commands
to allow you to run the content of this article without having to install anything on your local environment.
To run any code contained in this article on Azure Cloud Shell, open a Cloud Shell session, use the Copy button on a code block to copy the code, and paste it into the Cloud Shell session with Ctrl+Shift+V on Windows and Linux, or Cmd+Shift+V on macOS. Pasted text is not automatically executed, so press Enter to run code.
You can launch Azure Cloud Shell with:
|Select Try It in the upper-right corner of a code block. This doesn't automatically copy text to Cloud Shell.|
|Open Azure Cloud Shell in your browser.|
|Select the Cloud Shell button on the menu in the upper-right corner of the Azure portal.|
If you choose to install and use the CLI locally, this article requires that you are running the Azure CLI version 2.0 or later. To see the version installed, run the
az --version command. If you need to install or upgrade, see Install Azure CLI.
If you are running the CLI locally, you need to log in to your account using the az login command. Note the id property from the command output for the corresponding subscription name.
If you have multiple subscriptions, choose the appropriate subscription in which the resource should be billed. Select the specific subscription ID under your account using az account set command. Substitute the id property from the az login output for your subscription into the subscription id placeholder.
- The account must have the necessary permissions to create a virtual network and service endpoint.
Service endpoints can be configured on virtual networks independently, by a user with write access to the virtual network.
To secure Azure service resources to a VNet, the user must have permission to "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/" for the subnets being added. This permission is included in the built-in service administrator roles, by default and can be modified by creating custom roles.
VNets and Azure service resources can be in the same or different subscriptions. If the VNet and Azure service resources are in different subscriptions, the resources should be under the same Active Directory (AD) tenant.
It is highly recommended to read this article about service endpoint configurations and considerations before running the sample script below, or configuring service endpoints. Virtual Network service endpoint: A Virtual Network service endpoint is a subnet whose property values include one or more formal Azure service type names. VNet services endpoints use the service type name Microsoft.Sql, which refers to the Azure service named SQL Database. This service tag also applies to the Azure SQL Database, Azure Database for PostgreSQL and MySQL services. It is important to note when applying the Microsoft.Sql service tag to a VNet service endpoint it configures service endpoint traffic for all Azure Database services, including Azure SQL Database, Azure Database for PostgreSQL and Azure Database for MySQL servers on the subnet.
Sample script to create an Azure Database for PostgreSQL database, create a VNet, VNet service endpoint and secure the server to the subnet with a VNet rule
In this sample script, change the highlighted lines to customize the admin username and password. Replace the SubscriptionID used in the
az account set --subscription command with your own subscription identifier.
#!/bin/bash # To find the name of an Azure region in the CLI run this command: az account list-locations # Substitute <subscription id> with your identifier az account set --subscription <subscription id> # Create a resource group az group create \ --name myresourcegroup \ --location westus # Create a PostgreSQL server in the resource group # Name of a server maps to DNS name and is thus required to be globally unique in Azure. # Substitute the <server_admin_password> with your own value. az postgres server create \ --name mydemoserver \ --resource-group myresourcegroup \ --location westus \ --admin-user mylogin \ --admin-password <server_admin_password> \ --sku-name GP_Gen4_2 # Get available service endpoints for Azure region output is JSON # Use the command below to get the list of services supported for endpoints, for an Azure region, say "westus". az network vnet list-endpoint-services \ -l westus # Add Azure SQL service endpoint to a subnet *mySubnet* while creating the virtual network *myVNet* output is JSON az network vnet create \ -g myresourcegroup \ -n myVNet \ --address-prefixes 10.0.0.0/16 \ -l westus # Creates the service endpoint az network vnet subnet create \ -g myresourcegroup \ -n mySubnet \ --vnet-name myVNet \ --address-prefix 10.0.1.0/24 \ --service-endpoints Microsoft.SQL # View service endpoints configured on a subnet az network vnet subnet show \ -g myresourcegroup \ -n mySubnet \ --vnet-name myVNet # Create a VNet rule on the sever to secure it to the subnet. Note: resource group (-g) parameter is where the database exists. VNet resource group if different should be specified using subnet id (URI) instead of subnet, VNet pair. az postgres server vnet-rule create \ -n myRule \ -g myresourcegroup \ -s mydemoserver \ --vnet-name myVNet \ --subnet mySubnet
Clean up deployment
After the script sample has been run, the following command can be used to remove the resource group and all resources associated with it.
#!/bin/bash az group delete --name myresourcegroup
Send feedback about: