[SOLVED] What is Azure Private DNS Zone Group?

What is Azure Private DNS Zone Group?

I am automating some process with Azure Private DNS Zone and Private Endpoint. I have encountered with Private DNS Zone Group resource. There is a Rest API for this resource, here . But I couldn't find any documentation on the internet explaining the function of it. Neither, I could find it on the portal.

Any idea about its function?

Solution

Private DNS Zone Groups are a kind of link back to one or multiple Private DNS Zones. With this connection, an A-Record will automatically be created, updated or removed on the referenced Private DNS Zone depending on the Private Endpoint configuration.

This setting is analog to the following setting during manual creation in Azure Portal UI:

The account that adds the PrivateDNSZoneGroup needs to have the following permission on the Private DNS Zone:

Microsoft.Network/privateDnsZones/join/action

Example Scenario:

Hub and Spoke architecture. Hub has the Private DNS Zone for e.g. PostgreSQL Server with the name: privatelink.postgres.database.azure.com

Private Endpoints are created where the Service resides, e.g. a Spoke Subscription. The Private DNS Zone Group configuration on the Private Endpoint pointing to the Private DNS Zone in the Hub-Subscription.

With this setup, A-Records within the Private DNS Zone are maintained automatically.

With Azure DevOps, your Service Connection / Service Principal needs the following permission on the Private DNS Zones in the Hub, e.g. via a Custom Role: Microsoft.Network/privateDnsZones/join/action

An ARM template would look similar to this:

{
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
"apiVersion": "2021-03-01",
"name": "[concat(parameters('privateEndpointName'),'/customdnsgroup')]",
"location": "[parameters('location')]",
"dependsOn": [
    "[parameters('privateEndpointName')]"
],
"properties": {
    "privateDnsZoneConfigs": [
        {
            "name": "exampleConfig",
            "properties": {
                "privateDnsZoneId": "[parameters('privateDnsZoneResourceId')]"
            }
        }
    ]
  }
}

Additional Note: For me it only worked properly when the name of the Private DNS Zone was set to the official privatelink-FQDN of the specified resource. Otherwise, the A-Record was not automatically created.

Additional References