In this lesson,
we are going to talk about "Implementing Secure Endpoints".
We're going to look at what private endpoints are,
and spend just a few minutes talking about that.
Then, I'm going to jump into the portal
and I'm going to show you how we can connect to one live.
All right, so let's talk a little bit
about a private endpoint and what it actually is.
A private endpoint is just a way that you can create
to connect a virtual network to a specific Azure resource.
Now, this is really helpful because when you do that,
one, it can provide some additional security
because after you've created your private endpoint,
you can create additional rules
that will remove public internet access entirely.
So that's very helpful.
The other thing is,
if you want to leave your internet access open,
you can actually create filters
to restrict Azure service access
or better monitor what's actually going out of your network.
So with private endpoints,
you need to understand that this is only for endpoints
in Azure virtual network.
In addition to that,
you can only create endpoints in a handful of services.
Now, it's a reasonably large list,
but for the DP-203, we're primarily concerned
with Synapse, Storage, and Key Vault.
Those are the 3 that you're most likely
to use private endpoints on.
You can also do other services
like Event Hubs, Service Bus,
SQL database and some other services like that.
In addition, this is only for traffic
within a virtual network region.
So, you can't connect private endpoints
between services in different regions.
You can also create private endpoints
from on-prem connections,
either by specifying the IP address ranges
or by using ExpressRoute.
You can see that down here at the bottom.
All right, with that,
let me actually jump you in,
and let's take a look at the portal.
So here, we find ourselves in the portal
in my Synapse workspace.
And if I scroll down, you'll see
that I have a Private Endpoint Connections section here.
If I click on that, I can create a new private endpoint.
I just specify my resource group.
I give myself a name.
Go to Next,
and then I can choose my resource type.
So let's just say that I want to use a storage account.
I can choose that,
and then it allows me
to actually pick the storage account that I want to use.
And then I can target what in there I'm actually looking at.
That's pretty much it.
I go through the rest of that, and I can choose that.
And I'm going to just going to let this spin,
because this is going to take a little while.
But the next step is just skipping through tags,
and then finally, to the Review + Create section.
Now, the piece that's important about this
is this does not cost additional funds
to use private endpoints.
All right.
With that, just a couple of key points
that we need to remember for this lesson.
First, it's all about layers.
So, we're back into creating additional layers.
This is going to help us with 1 more tool
that we can use to separate our Azure environments
and separate the resources within our Azure environment
and our VNets.
Next, this is a minor topic on the DP-203.
I didn't spend a ton of time talking about networking
because this is a data engineering certification,
not a networking one.
So just get the basics for this one,
and you should be good to go.
All right, with that, it's on the next lesson.
I'll see you there.