How to Securely Connect to Azure Database for MySQL with Private Link

Private Link lets you connect safely to Azure Database for MySQL. It does this by making a private endpoint in your virtual network. When you use Private Link, your database traffic does not go on the public internet. This helps stop risks like people getting in without permission, IP-based attacks, and man-in-the-middle threats. You also help follow strict rules for data safety and privacy, like PCI DSS, HIPAA, and GDPR. Private endpoints only let known networks connect, so your setup is safer and easier to handle.

Key Takeaways

• Use Private Link to keep your Azure Database for MySQL traffic inside your private network. This helps you avoid the public internet and makes your data safer.

• Plan your network by making a special subnet. Set up private DNS zones and use virtual network peering. This helps your connections work well and stay safe.

• Make a private endpoint in your virtual network. Approve its connection so only trusted private traffic can reach your MySQL server.

• Test your private connection and DNS setup first. Do this before you turn off public access. This way, you will not lose access to your database.

• Check your security settings often. Remove resources you do not use. Watch your setup to keep your database safe and save money.

Prerequisites

Azure Account and Permissions

You need an active Azure account before you begin. You also must have the right permissions to set up Private Link for Azure Database for MySQL. If you do not have these permissions, you cannot make or manage private endpoints. The table below lists the main permission actions you need:

• Microsoft.DBforMySQL/servers/privateEndpointConnections/read

  See the list or details of private endpoint connections

• Microsoft.DBforMySQL/servers/privateEndpointConnections/write

  Approve or reject private endpoint connections

• Microsoft.DBforMySQL/servers/privateEndpointConnections/delete

  Remove private endpoint connections

• Microsoft.DBforMySQL/servers/privateLinkResources/read

  View private link resources for the MySQL server

• Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionProxies/read

  See private endpoint connection proxies

• Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionProxies/write

  Make or update private endpoint connection proxies

• Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionProxies/delete

  Remove private endpoint connection proxies

💡 Tip: If you are not sure about your permissions, ask your Azure admin to check or give you the needed roles.

Initial Public Access Requirement

When you make a new Azure Database for MySQL Flexible Server, you must allow public access at first. This step is needed so Azure can set up the server and connect it to your network. After you create the private endpoint, you can turn off public access. This change makes sure only private traffic can reach your database. Plan for a short time when the server is open to the public internet. Watch your server during this time to keep it safe.

Network Planning

You should plan your network before setting up Private Link. Good planning helps you avoid problems later. Here are some important things to think about:

📝 Note: Careful network planning saves time and stops problems during setup. Double-check your subnet, DNS, and peering settings before you start.

Virtual Network Setup

Create or Select VNet

You need a virtual network, called a VNet, to use Private Link with Azure Database for MySQL. The VNet is a safe area for your resources. If you already have a VNet, you can use it. If you do not, you must make a new one. A VNet needs an IP address range. This range lets Azure give a private IP to your private endpoint. The private endpoint is a special network interface. It links your MySQL server to your VNet. It does not use public IP addresses. This keeps your data traffic safe and private. DNS resolution is important too. Your VNet must let the full name of your MySQL server point to the private IP of the private endpoint. This step makes sure your apps use the private link. You can turn off public access after you finish setting up.

🛡️ Tip: Always check your VNet’s IP range. Make sure there are enough addresses for your private endpoints and other resources.

Subnet Configuration

You need to set up a subnet inside your VNet for the MySQL Flexible Server. Follow these steps to avoid problems: 1. Only let Microsoft.DBforMySQL/flexibleServers use the subnet. This keeps it just for MySQL Flexible Server. 2. Put the subnet and your MySQL Flexible Server in the same Azure region and subscription. 3. Use the subnet only for MySQL Flexible Server. Do not add other Azure resources. 4. Let Azure give out private IP addresses from this subnet to your private endpoints. 5. Set up the subnet to work with Private DNS zones. The DNS zone name should end with mysql.database.azure.com. 6. Once you put your MySQL Flexible Server in this subnet, you cannot change it back to public access.

📝 Note: Good subnet planning helps you avoid network problems and keeps your database safe. Always check your subnet settings before you move forward.

Deploy MySQL Server

Flexible Server Deployment

You must set up your MySQL Flexible Server before using private connections. Azure suggests a special way to do this. You should turn on private access when you make the server. This gives you private network access right away.

When you make your MySQL Flexible Server, do these steps: 1. Go to the Azure portal and start making a new MySQL Flexible Server. 2. Pick the private access choice. This step is key because it gives you private connections without needing a different Private Link endpoint. 3. Choose the virtual network (VNet) and subnet you got ready before. Make sure you use the subnet you saved for MySQL Flexible Server. 4. Connect the private DNS zone that matches your MySQL server’s domain, which usually ends with mysql.database.azure.com.

📝 Note: If you pick private access now, your server only lets in traffic from your VNet. This keeps your data safe and off the public internet.

Azure’s way for Flexible Server uses private access instead of the old Private Link. This way is simpler and matches what Azure now suggests.

Public Access Configuration

After you set up your server with private access, check the public access settings. Sometimes, Azure lets public access for a short time during setup. You should turn off public access as soon as your private connection works.

To do this: - Open your MySQL Flexible Server in the Azure portal. - Go to the Networking area. - Set public access to Disabled.

This stops all connections from the public internet. Only things inside your VNet can reach your MySQL server.

🔒 Tip: Always test your private connection before turning off public access. This helps you not get locked out by mistake.

Private Link Setup

Create Private Endpoint

You need to make a private endpoint to link your Azure Database for MySQL server to your virtual network. This lets your database use a private IP address. Your data stays inside your network and does not go on the public internet.

Here are the steps to make a private endpoint:

1. Open the Azure portal and find your MySQL Flexible Server.

2. Pick "Private access and Private endpoint" for how you want to connect.

3. Add a private endpoint. Fill in your project details, like your subscription and resource group.

4. Give your private endpoint a special name. Choose the same place as your MySQL server.

5. Pick the virtual network and subnet you set up before.

6. Turn on private DNS integration. Say "Yes" and pick or make a private DNS zone that ends with mysql.database.azure.com.

7. Save your choices and finish making the private endpoint.

🛡️

If you use more than one subscription, check that the resource provider for MySQL Flexible Server is registered in both subscriptions. After you make the private endpoint, look at your DNS settings. The full name of your MySQL server should now show the private IP address of your private endpoint.

Approve Connection Request

After you make the private endpoint, you need to say yes to the connection request. This lets your MySQL server take private traffic from your VNet.

To say yes to the connection request:

1. Go to your MySQL Flexible Server in the Azure portal.

2. Find the "Private endpoint connections" area.

3. Look for the new connection request. It will say "Pending."

4. Click the request and choose "Approve."

When you approve the request, your server only lets in connections through the private endpoint. This stops all public network access. Only trusted networks in your VNet or peered networks can reach your database. You lower the chance of attacks because your server does not use a public IP address.

🔒

Common Issues and Troubleshooting

You might have some problems when setting up Private Link. Here are some common issues and how to fix them:

• Firewall blocks: Make sure your firewall lets traffic from your client IP. Open port 3306 for MySQL.

• TLS errors: Azure needs TLS 1.2. Update your client if you see errors when connecting.

• DNS problems: Check that your DNS gives the private IP for your MySQL server. If it does not, update your private DNS zone.

• Wrong network: Make sure your client is in the right VNet or a peered network.

• Connection strings: Check your username and password again.

📝

Security and Performance Notes

When you use Private Link, you get a safe and private way to reach your database. You lower your risk by keeping your data off the public internet. You also let only trusted networks connect. This setup can make your network safer.

Private Link may change how your connections work. Your database uses a private IP, so only things in your VNet or peered networks can connect. This setup does not usually slow down your database, but you should use connection pooling for best speed. Always check your network settings to avoid trouble.

Cost Considerations

Private Link costs extra money. You pay for each private endpoint every hour. You also pay for data that moves through the private endpoint. These costs are added to your normal database charges. You do not pay for the Private Link service itself, but private endpoints and data transfer have fees. Plan your budget before you use Private Link.

Private DNS and Connectivity

Setting up private DNS is a key step when you use Private Link with Azure Database for MySQL. This setup makes sure your apps connect to the database using a private IP address. You avoid sending data over the public internet. You also make your network safer and easier to manage.

Configure Private DNS Zone

You need a private DNS zone to let your apps find the MySQL server’s private IP. Azure recommends using the DNS zone name privatelink.mysql.database.azure.com for MySQL Flexible Server. This name helps Azure create DNS records for your private endpoints automatically. You do not need to change your app’s connection string.

When you set up the private DNS zone, keep these points in mind:

• You must specify the full resource ID of the private DNS zone. You can find this in the Azure portal under Private DNS Zones using the JSON view.

• The private DNS zone is required even if you have not enabled private networking yet.

• If you do not set the DNS zone ID, Azure will create a new private DNS zone for you.

• You can set up the DNS zone using the Azure portal, CLI, or API. For example, you can use the cdp de enable-service command with the --azure-database-private-dns-zone-id flag.

• This setup works with services like Cloudera Data Engineering and ensures your DNS resolves to the right private IP.

💡

Link DNS to VNet

After you create the private DNS zone, you must link it to your virtual network. This step lets your apps and services in the VNet find the MySQL server using its private IP. Follow these steps to link the DNS zone:

1. Link the private DNS zone to the virtual network where your private endpoint lives.

2. Use a private DNS zone group to connect the DNS zone to the private endpoint. This lets Azure manage DNS records for you.

3. Use one private DNS zone for all your client connections. This includes on-premises networks and peered VNets. You get the same DNS results everywhere.

4. For hybrid networks, set up conditional forwarding from your on-premises DNS servers to Azure DNS forwarders or use Azure Private Resolver.

5. Make sure DNS queries come from VNets linked to the private DNS zone.

6. In a hub-and-spoke network, create the private DNS zone in the hub and link all spokes to it. This avoids duplicate zones.

7. Set up DNS forwarders to handle both private and public DNS lookups.

📝

Test Private Connection

You should always test your setup after you link the DNS zone. This step checks if your apps can reach the MySQL server using the private IP. Here is how you can test your private connection:

• Use the nslookup command from your app server. Check if the MySQL server’s DNS name points to the private IP.

• If you see the private IP, your DNS setup works.

• If you do not see the private IP, check that your app and MySQL server use the same VNet and DNS zone.

• Make sure firewall rules allow traffic from your app server to the MySQL server on port 3306.

• If you use custom DNS, confirm your DNS forwarders are set up right.

• Try connecting to the MySQL server using its full DNS name and check for errors.

• Use tools like Test-NetConnection or ping to check network access.

🚦

Testing your private connection ensures your Private Link setup is secure and ready for use. You keep your data safe and your apps connected.

Clean Up and Best Practices

Remove Unused Resources

When you finish setting up your Private Link connection, you should get rid of things you do not need. Extra resources can cost more money and make your setup less safe. Here are some easy steps to keep your space neat:

1. Delete old public endpoints: Take away any public endpoints or firewall rules you used during setup.

2. Remove test servers and endpoints: Get rid of test MySQL servers, private endpoints, or DNS zones you do not use anymore.

3. Check resource groups: Look at your resource groups for things left over from before.

4. Monitor costs: Use Azure Cost Management to watch how much you spend on private endpoints and other services.

5. Update documentation: Write down any changes so your team knows what is still being used.

🗑️

Review Security Settings

You should check your security settings often to keep your Private Link connection safe. Follow these tips to protect your Azure Database for MySQL:

1. Always use SSL connections on your MySQL server. This keeps your data safe from bad people.

2. Make sure the "Enforce SSL connection" setting is always turned on in Connection Security.

3. All clients should use TLS version 1.2 or newer for safe connections.

4. Check your network borders. Only let traffic from networks you trust.

You also need to control who can get in. The table below has some good tips:

You can use Azure Monitor, Microsoft Defender for Cloud, and Network Watcher to watch what is happening and check security. These tools help you see how things are working, find problems, and keep your database safe. Checking often and watching your setup helps keep your Private Link connection safe and working well.

Now you know how to make a safe connection to Azure Database for MySQL. A private endpoint keeps your data inside your own network. It does not go out to the public internet. This way, you get more control and better safety than using public endpoints.

• Your data traffic stays private with its own IP in your VNet.

• You can set who can get in and use network rules.

• On-premises and peered networks can connect in a safe way.
  Always take away things you do not use, check who has access, and watch your setup often.

FAQ

How do you know if your connection uses Private Link?

You can run the nslookup command on your MySQL server’s DNS name. If you see a private IP address, your connection uses Private Link.

Tip: Always check the IP address before turning off public access.

Can you use Private Link with on-premises networks?

Yes, you can. Set up a VPN or ExpressRoute to connect your on-premises network to your Azure VNet. Make sure your DNS can resolve the MySQL server’s private IP.

What happens if you delete the private endpoint?

Your apps lose access to the MySQL server through Private Link. You must create a new private endpoint to restore private connectivity.

🛑 Warning: Deleting the endpoint can cause downtime for your applications.

Do you need to change your application’s connection string?

No, you do not need to change it. The DNS setup makes sure your app connects to the private IP automatically.

Note: Always test your connection after setting up Private Link.

How do you troubleshoot connection issues?

• Check DNS resolution with nslookup.

• Make sure firewall rules allow traffic.

• Use Azure Network Watcher to test connectivity.

Tip: Review your VNet and DNS settings if you cannot connect.