Skip to content
Search ⌘K
Start a free trial

Private endpoints

Connect your services to Azure Private Link endpoints to eliminate public internet exposure

Tiger Cloud supports private connectivity through Azure Private Link. Once configured, applications in your Azure Virtual Network reach your service through a private endpoint on Microsoft's internal network, with no exposure to the public internet. This page walks you through provisioning the private endpoint in Azure, claiming it in Tiger Console, and attaching it to your service.

Prerequisites for this procedure

To follow these steps, you'll need:

Set up a private endpoint connection

Take the following steps to connect your Tiger Cloud service to a Private Link endpoint.

  1. Copy the alias for your region

    1. In Tiger Console, select Security > Private Endpoints > Manage endpoints.

    2. Under Create the endpoint, copy the Alias for the region in which you need to create the connection. Choose the region closest to your Azure resources for optimal performance.

      Copying the region alias in the Manage endpoints panel
  2. Create a private endpoint in Azure

    1. In Azure Portal, go to Private endpoints and click Create.

      Create Azure Private Endpoint

    2. In Subscription, select the subscription that contains the resources you want to connect to Tiger Cloud.

    3. In Resource group, select an existing resource group or create a new one for your private endpoint.

    4. Provide a name for your endpoint.

    5. Select the region where your Virtual Network is deployed, then click Next: Resource.

    6. In Connection method, select Connect to an Azure resource by resource ID or alias.

    7. In Resource ID or alias, paste the alias you have copied from Tiger Console.

    8. Leave Request message empty, then click Next: Virtual Network.

    9. Select the Virtual Network that contains the resources you want to connect to Tiger Cloud, then choose the subnet where the endpoint's private IP will be created. Optionally select an application security group, then click Next: DNS.

    10. Optionally configure private DNS integration and tags for your endpoint, then click Next: Review + create.

    11. Review your config and click Create. Azure creates your private endpoint. Wait for the deployment to succeed.

    12. Go to your private endpoint's Overview. Once Tiger Cloud approves the connection, the connection status message reads Connected. Claim this connection in the console using ID <ID>. Copy this ID; you claim the connection with it.

      The connection status message on an Azure private endpoint
      Note

      Approval takes up to a few minutes. The ID is your endpoint's resourceGuid, so you can also read it from JSON View under properties if you prefer.

    13. Go to Private endpoints and copy the private endpoint IP from the Private IP column.

  3. Claim the connection

    1. In Tiger Console > Security > Private Endpoints, click Manage endpoints.

    2. Under Claim it, paste the ID you copied into Endpoint identifier, then click Claim connection. Tiger Cloud links the connection to the project you are working in, and it appears in the list.

      Claiming a private endpoint connection with the endpoint identifier
      Note

      You can claim a private endpoint against one project only.

  4. Configure and attach

    1. Under IP Address click Add IP and paste the private endpoint IP address you have copied from Azure Portal.

    2. Under Services click Attach service. Select your service from the dropdown and click Attach. You can attach a service to one private endpoint.

      A private endpoint connection with an IP address and an attached service

    3. From a VM inside your Azure VNet, connect to your service using a connection string with your connection details. You should be able to connect successfully.

Manage connections

  • To detach a service from a private endpoint connection, go to Security > Private Endpoints, expand the arrow in the Services column, and click the trash icon next to the service connection string.
  • To edit or remove an endpoint connection, go to Security > Private Endpoints and click the three dots next to the connection in the list. Select Edit or Disconnect, respectively. You need to detach all services from a private endpoint connection before deleting it.