Unable to Create Private Endpoint Azure Postgres Flexible Server on Private Subnet

Gourab Nandi 0

Hello Everyone,

I've created a Postgres flexible server (16) on a private subnet which is delegated to PostgreSQL/flexibleServers, able to create the private DNS zone as well. But while creating the private endpoint I choose an already created Resource Group(same where db is), call my Private Endpoint "apdb-private-endpoint", in "Type of Resource" I choose "Microsoft.DBforPostgreSQL/flexibleServers", on "Resource", but when I choose my PostgreSQL flexible server its saying "No sub resource available"

Region: Central India

SKU: Standard_B1ms

ShaktiSingh-MSFT 15,421 Reputation points

2024-09-23T04:12:57.5066667+00:00

Hi Gourab Nandi,

We haven't heard back from you. In case you already found a solution, would you please share it here with the community? Otherwise, let us know and we will continue to engage with you on the issue.

Thanks

1 answer

ShaktiSingh-MSFT 15,421

Hi Gourab Nandi,

Welcome to Microsoft Q&A forum.

As I understand, you are Unable to Create Private Endpoint Azure Postgres Flexible Server on Private Subnet.

Private links are available only for servers that have public access networking. They can't be created for servers that have private access (virtual network integration).

Private links can be configured only for servers that were created after the release of this feature. Any server that existed before the release of the feature can't be set with private links.

Here are some limitations for working with virtual networks created via virtual network integration:

After an Azure Database for PostgreSQL flexible server is deployed to a virtual network and subnet, you can't move it to another virtual network or subnet. You can't move the virtual network into another resource group or subscription.
Subnet size (address spaces) can't be increased after resources exist in the subnet.
Virtual network injected resources can't interact with Private Link by default. If you want to use Private Link for private networking, see Azure Database for PostgreSQL - Flexible Server networking with Private Link.

Let me know if this meets in your case.

Thanks

Gourab Nandi 0

Hi , actually I'm trying to create the db from terraform. I have attached a Network Security Group (NSG) to the delegated private subnet associated with the PostgreSQL flexible server. Using location asCentral India and B_Standard_B1ms for db_sku.

Tried with different SKUs and locations as well but the same error.

Db.tf

"azurerm_private_dns_zone" "postgres_dns_zone" {

      name                = "${var.project_name}${var.environment}.postgres.database.azure.com"

      resource_group_name = var.resource_group

      tags                = var.tags

    }

    



    resource "azurerm_postgresql_flexible_server" "db" {

      name                          = "${var.project_name}${var.environment}postgres"

      resource_group_name           = var.resource_group

      location                      = var.location

      administrator_login           = var.db_admin

      administrator_password        = random_password.postgres_password.result

      sku_name                      = var.db_sku

      zone                          = var.zone

      version                       = var.db_version

      delegated_subnet_id           = var.subnet_id

      private_dns_zone_id           = azurerm_private_dns_zone.postgres_dns_zone.id

      storage_mb                    = var.db_storage

      backup_retention_days         = 7

      geo_redundant_backup_enabled  = false

      public_network_access_enabled = false

      dynamic "high_availability" {

        for_each = var.enable_ha ? [1] : []

        content {

          mode                     = "ZoneRedundant"

          standby_availability_zone = var.ha_zone

        }

      }

    

      depends_on                    = [azurerm_private_dns_zone.postgres_dns_zone]

      tags                          = var.tags

    }

    resource "azurerm_postgresql_flexible_server_configuration" "postgis" {

      name      = "azure.extensions"

      server_id = azurerm_postgresql_flexible_server.db.id

      value = "POSTGIS"

    }

    

    # Link private DNS zone with the VNet for PostgreSQL

    resource "azurerm_private_dns_zone_virtual_network_link" "pg_dns_vnet_link" {

      name                  = "${azurerm_postgresql_flexible_server.db.name}-vnetlink.com"

      resource_group_name   = var.resource_group

      private_dns_zone_name = azurerm_private_dns_zone.postgres_dns_zone.name

      virtual_network_id    = var.vnet_id

      tags                  = var.tags

      depends_on = [ azurerm_postgresql_flexible_server.db ]

    }

    

    

    # Private endpoint for PostgreSQL

    resource "azurerm_private_endpoint" "postgres_private_endpoint" {

      name                = "${azurerm_postgresql_flexible_server.db.name}-private-endpoint"

      resource_group_name = var.resource_group

      location            = var.location

      subnet_id           = var.subnet_id

      tags                = var.tags

    

      private_service_connection {

        name                           = "${azurerm_postgresql_flexible_server.db.name}-Connection"

        is_manual_connection           = false

        private_connection_resource_id = azurerm_postgresql_flexible_server.db.id

        subresource_names              = ["postgresqlServer"]

      }

    

      private_dns_zone_group {

        name = "${azurerm_postgresql_flexible_server.db.name}-private-dns-zone-group"

        private_dns_zone_ids = [

          azurerm_private_dns_zone.postgres_dns_zone.id

        ]  

      }

      depends_on = [ azurerm_postgresql_flexible_server.db,  azurerm_private_dns_zone.postgres_dns_zone ]

    

    }

The Vnet code is as below:

############

## VNET ##

############

resource "azurerm_virtual_network" "controltower_vnet" {

  name                = "${var.project_name}-${var.environment}-vnet"

  address_space       = var.cidr_range

  location            = var.location

  resource_group_name = var.resource_group

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



############

## SUBNET ##

############

resource "azurerm_subnet" "controltower_public" {

  count                = length(var.public_subnet_cidrs)

  name                 = "${var.project_name}-${var.environment}-public-subnet-${count.index + 1}"

  resource_group_name  = var.resource_group

  virtual_network_name = azurerm_virtual_network.controltower_vnet.name

  address_prefixes     = [var.public_subnet_cidrs[count.index]]

}



resource "azurerm_subnet" "controltower_private" {

  count                = length(var.private_subnet_cidrs)

  name                 = "${var.project_name}-${var.environment}-private-subnet-${count.index + 1}"

  resource_group_name  = var.resource_group

  virtual_network_name = azurerm_virtual_network.controltower_vnet.name

  address_prefixes     = [var.private_subnet_cidrs[count.index]]

  default_outbound_access_enabled = false

  dynamic "delegation" {

    for_each = count.index == 0 ? [1] : []

    content {

      name = "postgresql-delegation"

      

      service_delegation {

        name = "Microsoft.DBforPostgreSQL/flexibleServers"

        actions = [

          #"Microsoft.Network/networkinterfaces/*",

          #"Microsoft.Network/publicIPAddresses/join/action",

          #"Microsoft.Network/publicIPAddresses/read",

          #"Microsoft.Network/virtualNetworks/read",

          "Microsoft.Network/virtualNetworks/subnets/action",

          #"Microsoft.Network/virtualNetworks/subnets/join/action",

          #"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",

          #"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"

        ]

      }

    }

  }

  service_endpoints = count.index == 0 ? ["Microsoft.Sql" , "Microsoft.Storage"] : []



  private_endpoint_network_policies = "Enabled"

}



#########

## NAT ##

#########

resource "azurerm_public_ip" "controltower_nat_ip" {

  name                = "${var.project_name}-${var.environment}-nat-ip"

  location            = var.location

  resource_group_name = var.resource_group

  allocation_method   = "Static"

  sku                 = var.publicip_sku

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



resource "azurerm_nat_gateway" "controltower_nat" {

  name                = "${var.project_name}-${var.environment}-ngw"

  resource_group_name = var.resource_group

  location            = var.location

  sku_name            = var.nat_sku

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



resource "azurerm_nat_gateway_public_ip_association" "controltower_nat_association" {

  nat_gateway_id       = azurerm_nat_gateway.controltower_nat.id

  public_ip_address_id = azurerm_public_ip.controltower_nat_ip.id

}



# Associate NAT Gateway with private subnets

resource "azurerm_subnet_nat_gateway_association" "controltower_private_nat_association" {

  count          = length(var.private_subnet_cidrs)

  subnet_id      = azurerm_subnet.controltower_private[count.index].id

  nat_gateway_id = azurerm_nat_gateway.controltower_nat.id

}



#############

## ROUTING ##

#############



# Route table for private subnets

resource "azurerm_route_table" "controltower_private_rt" {

  name                = "${var.project_name}-private-rt"

  location            = var.location

  resource_group_name = var.resource_group

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



# Route table for public subnets

resource "azurerm_route_table" "controltower_public_rt" {

  name                = "${var.project_name}-public-rt"

  location            = var.location

  resource_group_name = var.resource_group

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



# **Single Route for Private Subnets**: This will apply to all private subnets via the NAT gateway

resource "azurerm_route" "controltower_private_route" {

  name                = "route-private"

  resource_group_name = var.resource_group

  route_table_name    = azurerm_route_table.controltower_private_rt.name

  address_prefix      = "0.0.0.0/0" # Route all outbound traffic

  next_hop_type       = "Internet"  # Azure handles NAT gateway routing automatically

}



# Route for public subnets (directly to Internet)

resource "azurerm_route" "controltower_public_route" {

  count               = length(var.public_subnet_cidrs)

  name                = "route-public-${count.index + 1}"

  resource_group_name = var.resource_group

  route_table_name    = azurerm_route_table.controltower_public_rt.name

  address_prefix      = "0.0.0.0/0" # Route all outbound traffic to the Internet

  next_hop_type       = "Internet"

}



##################

## ASSOCIATIONS ##

##################



# Associate private subnets with private route table

resource "azurerm_subnet_route_table_association" "controltower_private_association" {

  count          = length(var.private_subnet_cidrs)

  subnet_id      = azurerm_subnet.controltower_private[count.index].id

  route_table_id = azurerm_route_table.controltower_private_rt.id

}



# Associate public subnets with public route table

resource "azurerm_subnet_route_table_association" "controltower_public_association" {

  count          = length(var.public_subnet_cidrs)

  subnet_id      = azurerm_subnet.controltower_public[count.index].id

  route_table_id = azurerm_route_table.controltower_public_rt.id

}



#########

## NSG ##

#########

resource "azurerm_network_security_group" "controltower_nsg" {

  name                = "${var.project_name}-nsg"

  location            = var.location

  resource_group_name = var.resource_group

  tags                = var.tags

  lifecycle {

    ignore_changes = [tags]

  }

}



locals {

  port_rules = {

    for port in var.ports : port => {

      priority = 100 + index(var.ports, port)

      name     = "allow-${port}"

    }

  }

}



# Create security rules for each port

resource "azurerm_network_security_rule" "allow_inbound" {

  for_each = local.port_rules



  name                        = each.value.name

  priority                    = each.value.priority

  direction                   = "Inbound"

  access                      = "Allow"

  protocol                    = "Tcp"

  source_address_prefixes     = var.inbound_ips

  source_port_range           = "*"

  destination_address_prefix  = "*"

  destination_port_ranges     = [each.key]

  network_security_group_name = azurerm_network_security_group.controltower_nsg.name

  resource_group_name         = var.resource_group

}



######################

## NSG ASSOCIATIONS ##

######################



# Associate NSG with public subnets

resource "azurerm_subnet_network_security_group_association" "controltower_public_nsg_association" {

  count                     = length(var.public_subnet_cidrs)

  subnet_id                 = azurerm_subnet.controltower_public[count.index].id

  network_security_group_id = azurerm_network_security_group.controltower_nsg.id

}



# Associate NSG with private subnets

resource "azurerm_subnet_network_security_group_association" "controltower_private_nsg_association" {

  count                     = length(var.private_subnet_cidrs)

  subnet_id                 = azurerm_subnet.controltower_private[count.index].id

  network_security_group_id = azurerm_network_security_group.controltower_nsg.id

}

But getting the below error:

╷

│ Error: creating Private Endpoint (Subscription: "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

│ Resource Group Name: "test-dev-rg"

│ Private Endpoint Name: "testdevdb-private-endpoint"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: PrivateEndpointFeatureNotSupportedOnServer: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: The given server testdevdb does not support private endpoint feature. Please create a new server that is private endpoint capable. Refer to https://aka.ms/pgflex-pepreview for more details.

│

│   with module.DB.azurerm_private_endpoint.postgres_private_endpoint,

│   on ..\modules\database\db.tf line 68, in resource "azurerm_private_endpoint" "postgres_private_endpoint":

│   68: resource "azurerm_private_endpoint" "postgres_private_endpoint" {

│

ShaktiSingh-MSFT 15,421 Reputation points

2024-09-26T05:09:16.3233333+00:00
Thanks for the details.

Error says:

Private Endpoint Name: "testdevdb-private-endpoint"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: PrivateEndpointFeatureNotSupportedOnServer: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: The given server testdevdb does not support private endpoint feature. Please create a new server that is private endpoint capable.

Note

Private links are available only for servers that have public access networking. They can't be created for servers that have private access (virtual network integration).

Private links can be configured only for servers that were created after the release of this feature. Any server that existed before the release of the feature can't be set with private links.

The following situations and outcomes are possible when you use Private Link in combination with firewall rules:

If you don't configure any firewall rules, by default, traffic can't access the Azure Database for PostgreSQL flexible server.

If you configure public traffic or a service endpoint and you create private endpoints, different types of incoming traffic are authorized by the corresponding type of firewall rule.

If you don't configure any public traffic or service endpoint and you create private endpoints, the Azure Database for PostgreSQL flexible server is accessible only through private endpoints. If you don't configure public traffic or a service endpoint, after all approved private endpoints are rejected or deleted, no traffic can access the Azure Database for PostgreSQL flexible server.

The virtual network and subnet should be in the same region and subscription as your Azure Database for PostgreSQL flexible server instance.

The virtual network shouldn't have any resource lock set at the VNET or subnet level, as locks may interfere with operations on the network and DNS. Make sure to remove any lock (Delete or Read only) from your VNET and all subnets before creating the server in a virtual network, and you can set it back after server creation.

Let us know if above conditions meet for your server.

Awaiting your reply.

Thanks
Gourab Nandi 0 Reputation points

2024-09-26T05:30:41.98+00:00

Hi thank you very much for your inputs, could you please help me to understand what changes should I make so that only resource inside the same vnet or peered vnet can access the database
Gourab Nandi 0 Reputation points

2024-09-26T19:04:11.97+00:00

Hi @Shaktisingh did you get any chance to look into my previous comment?
ShaktiSingh-MSFT 15,421 Reputation points

2024-09-27T05:10:02.96+00:00
Hi Gourab Nandi,

Moving in and out of a virtual network is currently not supported.

Combining public access with deployment in a virtual network is currently not supported.

Firewall rules aren't supported on virtual networks. You can use network security groups instead.

Public access database servers can connect to the public internet; for example, through postgres_fdw. You can't restrict this access. Servers in virtual networks can have restricted outbound access through network security groups.

Please refer to the Microsoft documentation for more details.

If you configure public traffic or a service endpoint and you create private endpoints, then different types of incoming traffic are authorized by the corresponding type of firewall rule.

If you don't configure any public traffic or service endpoint and you create private endpoints, then the Azure Database for PostgreSQL Flexible server is accessible only through the private endpoints. If you don't configure public traffic or a service endpoint, after all approved private endpoints are rejected or deleted, no traffic will be able to access the Azure Database for PostgreSQL Flexible server.

Networking overview - Azure Database for PostgreSQL - Flexible Server with Private Link connectivity | Microsoft Learn

Thanks

Share via

Unable to Create Private Endpoint Azure Postgres Flexible Server on Private Subnet

1 answer

Your answer