vnet 中的多个子网需要通过专用终结点/服务终结点访问同一存储帐户

Question

Would this understanding be correct?
In order to achieve the objective of connecting multiple subnets in a vnet to a single storage account using:
1.Service Endpoint - requires a service endpoint to be created in each subnet
2.Private Endpoint - single private endpoint in the vnet is sufficient for all subnets of this vnet(and same private endpoint works across peered vnets too,unlike service endpoints).

Regards,
Aditya Garg

Answer 1

That understanding is correct. Service endpoints are created on the subnet level and need to be specified there, like in that Terraform example here:

resource "azurerm_subnet" "database-subnet" {
  name = "database-subnet"
  address_prefixes = ["10.0.2.0/24"]
  resource_group_name = var.resourcegroup_name
  virtual_network_name = azurerm_virtual_network.vnet1.name
  service_endpoints = [ "Microsoft.Sql" ]
}

A private endpoint on the other hand gives you an IP in your own vnet representing a specific instance of a PaaS-Service (like a specific database within the Azure SQL Database service). That internal IP is reachable from all your subnets. Intra-Subnet routing is done by default in Azure, so there's no need to set up some sort of custom / user defined routing.

When using service endpoints together with network security groups (nsg) on the subnet(s), one has to make sure to best use "service tags" within the nsg rules, since otherwise the system can break when PaaS-Services change their IP-ranges which might have been used in the nsg rules. So service tags are used instead of IP ranges in that scenario.

And of course like briefly mentioned in one of the answers in the linked question, there are further differences between the two options. I only like to mention the pricing very quickly: Service endpoints are completely free of charge, whereas service endpoints have a pricing per hour + per data volume being send through them.