Azure Key Vault 不允许在专用终结点连接中添加来自 azure 门户的机密

Question

I've an azure key vault that has configured with a private endpoint in virtual.network. After configuring the private endpoint, I'm not able to add any new secrets to the key vault.

Is there a way to add/edit secrets from azure portal in a key vault while it is configured with a private endpoint.

Note: I know that we can access the key vault from a virtual machine within same virtual.network and add/edit secrets in the key vault.

Answer 1

That is the whole point of Private Endpoints. The Key Vault data plane is now ONLY accessible by resources that are sitting on a machine, cluster, or environment connected to the Virtual Network where the Private Endpoint resource was deployed.

https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-diagnostics

Answer 2

There are 2 ways I can think of to get this done.

1. As a stop gap hack, you can add your current IP as client to the key-vault, when private endpoints are enabled.Go to Key-vault networking --> firewall and .net --> selected.network --> add client IP of your machine

2. Second way is to have Express Route connectivity to your on-premise corporate.network into the private endpoint .NET (or VNet peering if you have VM in cloud). Recommendation is to use hub-spoke topology for.network. Please refer below link.

Hub-spoke.network topology in Azure