Hiding App Service behind a VNet

[mikhailshilkov]

One problem with Azure App Service has always been the fact that it's open to the internet. This is changing: Azure has a preview feature to Integrate your app with an Azure Virtual Network in combination with Access Restrictions and Service Endpoints.

This post summarizes how to use this integration to isolate backend API from public access.

The feature is in preview, and the tooling is somewhat half-baked so far. There is a How do we integrate the new vnet integration with ARM templates? issue for ARM templates docs, but the feature seems to work.

Terraform still lags behind: App Service VNET integration not working, Problem with IP Restriction rules in azurerm_app_service resource. Therefore, Pulumi support is lacking too.

I'm creating this issue to track progress, as the case seems to be important for enterprisy Azure users.

[NoNameProvided]

Hi @viveklak!

I see this landed in the next-gen version, this means this wont be backported to the current Azure provider?

[viveklak]

Hi @viveklak!

I see this landed in the next-gen version, this means this wont be backported to the current Azure provider?

I believe complete support for this in the azure provider is currently still blocked behind hashicorp/terraform-provider-azurerm#2488. However, it is entirely possible for you to mix providers and use the nextgen provider to achieve this.