Private Endpoint cho Storage Account + Private DNS Zone

1. Virtual networks → vnet-az500-private → Subnets → + Subnet
   - Name: snet-pe
   - Address range: 10.10.3.0/24
   - (Không cần Service Endpoint cho subnet PE)

2. Storage accounts → + Create
   Basics:
   - Name: staz500lab29[random]
   - Resource group: rg-az500-ch07-private
   - Region: Southeast Asia
   Advanced:
   - Minimum TLS version: TLS 1.2
   - Allow Blob anonymous access: Disabled
   Networking:
   - Network access: "Disable public access and use private access"
   (Hoặc chọn "Enable from selected..." rồi tắt sau khi tạo PE)

3. Review + Create → Create

# Thêm subnet cho Private Endpoint (disable network policies — bắt buộc)
az network vnet subnet create \
  --name snet-pe \
  --vnet-name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --address-prefix 10.10.3.0/24 \
  --disable-private-endpoint-network-policies true

# Tạo Storage Account (public access tắt từ đầu)
az storage account create \
  --name staz500lab29xk9m \
  --resource-group rg-az500-ch07-private \
  --location southeastasia \
  --sku Standard_LRS \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --public-network-access Disabled

1. Storage account → Networking → Private endpoint connections → + Private endpoint
   (hoặc Portal → Private endpoints → + Create)

   Basics:
   - Name: pe-storage-lab29
   - Resource group: rg-az500-ch07-private
   - Region: Southeast Asia

   Resource:
   - Resource type: Microsoft.Storage/storageAccounts
   - Resource: staz500lab29[random]
   - Target sub-resource: blob ← chọn blob

   Virtual Network:
   - Virtual network: vnet-az500-private
   - Subnet: snet-pe

   DNS:
   - Integrate with private DNS zone: Yes ← QUAN TRỌNG
   - Private DNS zone: (tự tạo) privatelink.blob.core.windows.net

2. Review + Create → Create
   Đợi ~2 phút để provisioning hoàn tất

# Lấy Storage Account ID
STORAGE_ID=$(az storage account show \
  --name staz500lab29xk9m \
  --resource-group rg-az500-ch07-private \
  --query id -o tsv)

# Tạo Private Endpoint
az network private-endpoint create \
  --name pe-storage-lab29 \
  --resource-group rg-az500-ch07-private \
  --vnet-name vnet-az500-private \
  --subnet snet-pe \
  --private-connection-resource-id $STORAGE_ID \
  --group-id blob \
  --connection-name conn-storage-lab29 \
  --location southeastasia

# Xem private IP được gán
az network private-endpoint show \
  --name pe-storage-lab29 \
  --resource-group rg-az500-ch07-private \
  --query "customDnsConfigs[].{FQDN:fqdn, IP:ipAddresses}" \
  --output table

FQDN                                              IP
------------------------------------------------  -----------
staz500lab29xk9m.blob.core.windows.net            10.10.3.4

# Tạo Private DNS Zone
az network private-dns zone create \
  --resource-group rg-az500-ch07-private \
  --name "privatelink.blob.core.windows.net"

# Link DNS Zone với VNet (bắt buộc để VM trong VNet dùng DNS này)
az network private-dns link vnet create \
  --resource-group rg-az500-ch07-private \
  --zone-name "privatelink.blob.core.windows.net" \
  --name link-vnet-az500-private \
  --virtual-network vnet-az500-private \
  --registration-enabled false

# Lấy NIC ID của Private Endpoint để tìm private IP
NIC_ID=$(az network private-endpoint show \
  --name pe-storage-lab29 \
  --resource-group rg-az500-ch07-private \
  --query "networkInterfaces[0].id" -o tsv)

PRIVATE_IP=$(az network nic show --ids $NIC_ID \
  --query "ipConfigurations[0].privateIPAddress" -o tsv)

# Tạo A record trong DNS Zone
az network private-dns record-set a add-record \
  --resource-group rg-az500-ch07-private \
  --zone-name "privatelink.blob.core.windows.net" \
  --record-set-name staz500lab29xk9m \
  --ipv4-address $PRIVATE_IP

echo "Private IP: $PRIVATE_IP"

1. Portal → Private DNS zones → privatelink.blob.core.windows.net
2. Overview → xem Record sets: có A record trỏ về 10.10.3.4
3. Virtual network links → thấy vnet-az500-private với Status: Completed
4. Storage account → Networking → Private endpoint connections
   → pe-storage-lab29: Connection state = Approved

1. Storage account → Networking → Firewalls and virtual networks
2. Public network access: "Disabled"
3. Save

# Tắt public network access hoàn toàn
az storage account update \
  --name staz500lab29xk9m \
  --resource-group rg-az500-ch07-private \
  --public-network-access Disabled

# Xác nhận
az storage account show \
  --name staz500lab29xk9m \
  --resource-group rg-az500-ch07-private \
  --query "{publicNetworkAccess:publicNetworkAccess, minimumTlsVersion:minimumTlsVersion}" \
  --output table

PublicNetworkAccess    MinimumTlsVersion
---------------------  -----------------
Disabled               TLS1_2

# SSH vào VM trong VNet
ssh azureuser@<public-ip-vm>

# Kiểm tra DNS phân giải về private IP
nslookup staz500lab29xk9m.blob.core.windows.net
# Expected output:
# Server: 168.63.129.16 (Azure DNS)
# Non-authoritative answer:
# Name: staz500lab29xk9m.privatelink.blob.core.windows.net
# Address: 10.10.3.4  ← PRIVATE IP!

# Cài azure-cli
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
az login --use-device-code

# Upload file qua private endpoint
echo "Lab 29 private endpoint test" > /tmp/test29.txt
az storage blob upload \
  --account-name staz500lab29xk9m \
  --container-name lab29-container \
  --name test29.txt \
  --file /tmp/test29.txt \
  --auth-mode login
# Kết quả: Finished[#############] 100%

# Kiểm tra từ ngoài VNet (máy local) — phải bị từ chối
# nslookup sẽ trả về public IP → nhưng storage từ chối vì public access Disabled