Bicep: Private DNS zones, Private Endpoints, and DNS Records done right

Question

I am deploying PEs in my Vnet (dedicated Snet) that are linked to Web App resources deployed with Vnet integration. My understanding is that I need to add A records in the Private DNS Zone. This is turning out to be a lot harder than I would have expected.

How do I add my DNS records in this scenario since I can't add the records until I have deployed my PEs (need the IPs)? Any suggestions on best practices? I've gone in multiple different directions and still haven't found a solution that works effectively.

My thinking is to build an output based on something like this so that I can get each PE details, but I can't seem to get it right. Or maybe there is a better way?

 param privateEndpoints array
    
    // Deploy Private Endpoints
    resource privateEndpoint 'Microsoft.Network/privateEndpoints@2024-05-01' = [for pe in privateEndpoints: {
      name: pe.name
      location: pe.location
      properties: {
        subnet: {
          id: pe.properties.subnetId
        }
        privateLinkServiceConnections: [
          {
            name: 'link-to-${pe.name}' // Logical name for the private link service connection
            properties: {
              privateLinkServiceId: pe.properties.privateLinkServiceId // Reference the service being linked to
              groupIds: pe.properties.groupIds
            }
          }
        ]
      }
    }]

Answer 1

Try https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-bicep?tabs=CLI

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Though not very well documented, the correct way to do this is to use Private DNS Zone Groups tied to each Private Endpoint. This is the only official documentation I could find: (https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns-integration?source=recommendations#private-dns-zone-group)

Some key points:

• A-Record will automatically be created, updated or removed on the referenced Private DNS Zone based on the Private Endpoint configuration.
• It only worked if the name of the Private DNS Zone matches exactly with the official Azure Private DNS zone name for that specified resource type (documentation)
• One Private DNS Zone Group per Private Endpoint

It will look something like this:

param privateEndpoints array

resource privateEndpointDnsGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2024-05-01' = [for pe in privateEndpoints: {
	name: '${pe.name}/default'
	properties: {
		privateDnsZoneConfigs: [
	{
		name: '${pe.name}-config'
		properties: {
			privateDnsZoneId: pe.dnsZone
		}
	}
	]
}
}]