Azure
Networking
intermediate
Private Endpoints Everywhere — Azure Architecture Template
VNet-integrated web app reaching SQL, Storage and Key Vault exclusively over private endpoint NICs with private DNS.
Why this architecture works
- Every PaaS dependency is reached through a private endpoint, so public firewall rules can be set to deny-all
- Private DNS zones make the same connection strings resolve privately with zero code change
- VNet integration on the web app forces all its egress into the controlled network
- Data exfiltration surface shrinks: endpoints map to one specific resource, not a whole service
- Log Analytics records the app's dependency calls to prove no traffic bypasses the private path
What's inside (10 resources)
App VNet
virtual-network
Private DNS
dns-zone
Web App
web-app
PE: SQL
network-interface
PE: Storage
network-interface
PE: Key Vault
network-interface
SQL Server
sql-server
Storage
storage-account
Key Vault
key-vault
Logs
log-analytics-workspace
From template to running infrastructure
- Open this template in the CloudForge visual designer (free account, no credit card).
- Customize resources, names, and connections on the drag-and-drop canvas — or ask Vani, the AI architect, to adapt it.
- Generate production-ready Terraform, ARM, or Bicep in one click.
- Review the plan diff and security scan, then deploy with human approval.