教程:使用 Azure 专用终结点连接到存储帐户Tutorial: Connect to a storage account using an Azure Private Endpoint

Azure 专用终结点是 Azure 中专用链接的构建基块。Azure Private endpoint is the fundamental building block for Private Link in Azure. 它使 Azure 资源(例如虚拟机 (VM))能够以私密方式来与专用链接资源通信。It enables Azure resources, like virtual machines (VMs), to communicate with Private Link resources privately.

在本教程中,你将了解如何执行以下操作:In this tutorial, you learn how to:

  • 创建虚拟网络和 Bastion 主机。Create a virtual network and bastion host.
  • 创建虚拟机。Create a virtual machine.
  • 创建采用专用终结点的存储帐户。Create storage account with a private endpoint.
  • 测试到存储帐户专用终结点的连接。Test connectivity to storage account private endpoint.

如果没有 Azure 订阅,请在开始前创建一个试用版订阅If you don't have an Azure subscription, create a trial subscription before you begin.

先决条件Prerequisites

  • Azure 订阅An Azure subscription

登录 AzureSign in to Azure

登录 Azure 门户Sign in to the Azure portal.

创建虚拟网络和堡垒主机Create a virtual network and bastion host

在本部分中,你将创建虚拟网络、子网和堡垒主机。In this section, you'll create a virtual network, subnet, and bastion host.

堡垒主机将用于安全地连接到虚拟机,以测试专用终结点。The bastion host will be used to connect securely to the virtual machine for testing the private endpoint.

  1. 在屏幕的左上方选择“创建资源”>“网络”>“虚拟网络”,或者在搜索框中搜索“虚拟网络”。 On the upper-left side of the screen, select Create a resource > Networking > Virtual network or search for Virtual network in the search box.

  2. 在“创建虚拟网络” 的“基本信息”选项卡中输入或选择以下信息 :In Create virtual network, enter or select this information in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“myResourceGroup”Select myResourceGroup
    实例详细信息Instance details
    名称Name 输入“myVNet”Enter myVNet
    区域Region 选择“中国东部 2” Select China East 2
  3. 选择“IP 地址”选项卡 ,或选择页面底部的“下一步: IP 地址”按钮。Select the IP Addresses tab or select the Next: IP Addresses button at the bottom of the page.

  4. 在“IP 地址” 选项卡上,输入以下信息:In the IP Addresses tab, enter this information:

    设置Setting Value
    IPv4 地址空间IPv4 address space 输入“10.1.0.0/16”Enter 10.1.0.0/16
  5. 在“子网名称”下,选择词语“默认”。Under Subnet name, select the word default.

  6. 在“编辑子网”中输入以下信息: In Edit subnet, enter this information:

    设置Setting Value
    子网名称Subnet name 输入 mySubnetEnter mySubnet
    子网地址范围Subnet address range 输入“10.1.0.0/24”Enter 10.1.0.0/24
  7. 选择“保存” 。Select Save.

  8. 选择“安全”选项卡。Select the Security tab.

  9. 在“BastionHost”下,选择“启用” 。Under BastionHost, select Enable. 输入此信息:Enter this information:

    设置Setting Value
    Bastion 名称Bastion name 输入“myBastionHost”Enter myBastionHost
    AzureBastionSubnet 地址空间AzureBastionSubnet address space 输入“10.1.1.0/24”Enter 10.1.1.0/24
    公共 IP 地址Public IP Address 选择“新建”。Select Create new.
    对于“名称”,请输入“myBastionIP” 。For Name, enter myBastionIP.
    选择“确定”。Select OK.
  10. 选择“查看 + 创建”选项卡,或选择“查看 + 创建”按钮。Select the Review + create tab or select the Review + create button.

  11. 选择“创建”。Select Create.

创建虚拟机Create a virtual machine

在本部分中,你将创建将用来测试专用终结点的虚拟机。In this section, you'll create a virtual machine that will be used to test the private endpoint.

  1. 在门户的左上角,选择“创建资源”,在“新建”页的搜索筛选器中键入“Windows Server 2019 Datacenter”,然后在搜索结果中选择“Windows Server 2019 Datacenter”,接着选择“创建” 。On the upper-left side of the portal, select Create a resource, type Windows Server 2019 Datacenter in the search filter in New Page, then select Windows Server 2019 Datacenter item in search results and select Create.

  2. 在“创建虚拟机”中,在“基本信息”选项卡中键入或选择值:In Create a virtual machine, type or select the values in the Basics tab:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“myResourceGroup”Select myResourceGroup
    实例详细信息Instance details
    虚拟机名称Virtual machine name 输入“myVM”Enter myVM
    区域Region 选择“中国东部 2”Select China east 2
    可用性选项Availability Options 选择“无需基础结构冗余”Select No infrastructure redundancy required
    映像Image 选择“Windows Server 2019 Datacenter - Gen1”Select Windows Server 2019 Datacenter - Gen1
    大小Size 选择 VM 大小或采用默认设置Choose VM size or take default setting
    管理员帐户Administrator account
    用户名Username 输入用户名Enter a username
    密码Password 输入密码Enter a password
    确认密码Confirm password 重新输入密码Reenter password
  3. 选择“网络”选项卡,或选择“下一步: 磁盘”,然后选择“下一步: 网络”。Select the Networking tab, or select Next: Disks, then Next: Networking.

  4. 在“网络”选项卡中,选择或输入:In the Networking tab, select or enter:

    设置Setting Value
    网络接口Network interface
    虚拟网络Virtual network myVNetmyVNet
    子网Subnet mySubnetmySubnet
    公共 IPPublic IP 选择“无”。Select None.
    NIC 网络安全组NIC network security group 基本Basic
    公共入站端口Public inbound ports 选择“无”。Select None.
  5. 选择“查看 + 创建”。Select Review + create.

  6. 检查设置,然后选择“创建”。Review the settings, and then select Create.

备注

Azure 为未获得公共 IP 地址或位于内部基本 Azure 负载均衡器后端池中的 Azure 虚拟机提供临时 IP。Azure provides an ephemeral IP for Azure Virtual Machines which aren't assigned a public IP address, or are in the backend pool of an internal Basic Azure Load Balancer. 临时 IP 机制可提供无法配置的出站 IP 地址。The ephemeral IP mechanism provides an outbound IP address that isn't configurable.

如果将公共 IP 地址分配给某个虚拟机或将该虚拟机置入具有或不具有出站规则的标准负载均衡器的后端池中时,将禁用其原有的临时 IP。The ephemeral IP is disabled when a public IP address is assigned to the virtual machine or the virtual machine is placed in the backend pool of a Standard Load Balancer with or without outbound rules. 如果向虚拟机的子网分配 Azure 虚拟网络 NAT 网关资源,也会禁用其临时 IP。If a Azure Virtual Network NAT gateway resource is assigned to the subnet of the virtual machine, the ephemeral IP is disabled.

有关 Azure 中出站连接的详细信息,请参阅为出站连接使用源网络地址转换 (SNAT)For more information on outbound connections in Azure, see Using Source Network Address Translation (SNAT) for outbound connections.

创建采用专用终结点的存储帐户Create storage account with a private endpoint

在本部分中,你将创建存储帐户并配置专用终结点。In this section, you'll create a storage account and configure the private endpoint.

  1. 在左侧菜单中,选择“创建资源” > “存储” > “存储帐户”,或者在搜索框中搜索“存储帐户”。 In the left-hand menu, select Create a resource > Storage > Storage account, or search for Storage account in the search box.

  2. 在“创建存储帐户”的“基本信息”选项卡中,输入或选择以下信息:In the Basics tab of Create storage account enter or select the following information:

    设置Setting Value
    项目详细信息Project Details
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“myResourceGroup”Select myResourceGroup
    实例详细信息Instance details
    存储帐户名称Storage account name 输入 mystorageaccountEnter mystorageaccount. 如果该名称不可用,请输入一个唯一的名称。If the name is unavailable, enter a unique name.
    位置Location 选择“中国东部 2”Select China East 2
    性能Performance 保留默认值“标准”Leave the default Standard
    帐户类型Account kind 保留默认设置“StorageV2(常规用途 v2)”。Leave the default StorageV2 (general purpose v2)
    复制Replication 保留默认值“读取访问异地冗余存储 (RA-GRS)”Leave the default Read-access geo-redundant storage (RA-GRS)
  3. 选择“网络”选项卡,或选择“下一步: 网络”按钮。Select the Networking tab or select the Next: Networking button.

  4. 在“网络”选项卡中,在“连接方法”下,选择“专用终结点”。In the Networking tab, under Connectivity method select Private endpoint.

  5. 在“专用终结点”中,选择“+ 添加”。In Private endpoint, select + Add.

  6. 在“创建专用终结点”中,输入或选择以下信息:In Create private endpoint enter or select the following information:

    设置Setting Value
    订阅Subscription 选择 Azure 订阅Select your Azure subscription
    资源组Resource Group 选择“myResourceGroup”Select myResourceGroup
    位置Location 选择“中国东部 2”Select China east 2
    “属性”Name 输入 myPrivateEndpointEnter myPrivateEndpoint
    存储子资源Storage subresource 保留默认值“blob”Leave the default blob
    联网Networking
    虚拟网络Virtual network 选择 myVNetSelect myVNet
    子网Subnet 选择“mySubnet”Select mySubnet
    专用 DNS 集成Private DNS integration
    与专用 DNS 区域集成Integrate with private DNS zone 保留默认值“是”Leave the default Yes
    专用 DNS 区域Private DNS Zone 保留默认值“(新)privatelink.blob.core.chinacloudapi.cn”Leave the default (New) privatelink.blob.core.chinacloudapi.cn
  7. 选择“确定”。Select OK.

  8. 选择“查看 + 创建” 。Select Review + create.

  9. 选择“创建”。Select Create.

  10. 在左侧导航窗格中选择“资源组”。Select Resource groups in the left-hand navigation pane.

  11. 选择“myResourceGroup”。Select myResourceGroup.

  12. 选择你在之前的步骤中创建的存储帐户。Select the storage account you created in the previous steps.

  13. 在存储帐户的“设置”部分中,选择“访问密钥”。 In the Settings section of the storage account, select Access keys.

  14. 对于“key1”,选择 连接字符串 上的“复制”。Select copy on the Connection string for key1.

测试到专用终结点的连接Test connectivity to private endpoint

在本部分中,你将使用在上一步骤中创建的虚拟机通过专用终结点连接到存储帐户。In this section, you'll use the virtual machine you created in the previous step to connect to the storage account across the private endpoint.

  1. 在左侧导航窗格中选择“资源组”。Select Resource groups in the left-hand navigation pane.

  2. 选择“myResourceGroup”。Select myResourceGroup.

  3. 选择“myVM”。Select myVM.

  4. myVM 的“概述”页上,选择“连接”,然后选择“堡垒”。On the overview page for myVM, select Connect then Bastion.

  5. 选择蓝色的“使用堡垒”按钮。Select the blue Use Bastion button.

  6. 输入在创建虚拟机期间输入的用户名和密码。Enter the username and password that you entered during the virtual machine creation.

  7. 连接后,在服务器上打开 Windows PowerShell。Open Windows PowerShell on the server after you connect.

  8. 输入 nslookup <storage-account-name>.blob.core.chinacloudapi.cnEnter nslookup <storage-account-name>.blob.core.chinacloudapi.cn. <storage-account-name> 替换为你在前面步骤中创建的存储帐户的名称。Replace <storage-account-name> with the name of the storage account you created in the previous steps. 你将收到类似于以下所示内容的消息:You'll receive a message similar to what is displayed below:

    Server:  UnKnown
    Address:  168.63.129.16
    
    Non-authoritative answer:
    Name:    mystorageaccount8675.privatelink.blob.core.chinacloudapi.cn
    Address:  10.1.0.5
    Aliases:  mystorageaccount8675.blob.core.chinacloudapi.cn
    

    将为存储帐户名称返回专用 IP 地址 10.1.0.5A private IP address of 10.1.0.5 is returned for the storage account name. 此地址位于你之前创建的虚拟网络的子网中。This address is in the subnet of the virtual network you created previously.

  9. 在虚拟机上安装 Microsoft Azure 存储资源管理器Install Microsoft Azure Storage Explorer on the virtual machine.

  10. 安装“Microsoft Azure 存储资源管理器”后选择“完成”。 Select Finish after the Microsoft Azure Storage Explorer is installed. 保持选中此复选框以打开应用程序。Leave the box checked to open the application.

  11. 在“连接到 Azure 存储”屏幕中,选择“存储帐户或服务” > “连接字符串(密钥或 SAS)” 。In the Connect to Azure Storage screen, select Storage account or service > Connection string(Key or SAS).

  12. 选择“下一页”。Select Next.

  13. 在“显示名称”中输入来自之前步骤的存储帐户名称。Enter your storage account name from the previous steps in Display name.

  14. 在“连接字符串”下的框中,粘贴在前面步骤中复制的存储帐户的连接字符串。In the box under Connection String, paste the connection string from the storage account you copied in the previous steps.

  15. 选择“下一页”。Select Next.

  16. 在“连接摘要”中验证设置是否正确。Verify the settings are correct in Connection Summary.

  17. 选择“连接” 。Select Connect.

  18. 关闭到 myVM 的连接。Close the connection to myVM.

清理资源Clean up resources

如果你不打算继续使用此应用程序,请按以下步骤删除虚拟网络、虚拟机和存储帐户:If you're not going to continue to use this application, delete the virtual network, virtual machine, and storage account with the following steps:

  1. 从左侧菜单中,选择“资源组”。From the left-hand menu, select Resource groups.

  2. 选择“myResourceGroup”。Select myResourceGroup.

  3. 选择“删除资源组”。Select Delete resource group.

  4. 在“键入资源组名称”中输入“myResourceGroup”。 Enter myResourceGroup in TYPE THE RESOURCE GROUP NAME.

  5. 选择“删除” 。Select Delete.

后续步骤Next steps

了解如何创建专用链接服务:Learn how to create a Private Link service: