How do I set up Azure Blob storage with no public access and a private endpoint for a WebApp VNet?

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure-native";

// Create a resource group
const resourceGroup = new azure.resources.ResourceGroup("resourceGroup", {
    location: "WestUS",
});

// Create a virtual network
const vnet = new azure.network.VirtualNetwork("vnet", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    addressSpace: { addressPrefixes: ["10.0.0.0/16"] },
});

// Create a subnet within the virtual network
const subnet = new azure.network.Subnet("subnet", {
    resourceGroupName: resourceGroup.name,
    virtualNetworkName: vnet.name,
    addressPrefix: "10.0.1.0/24",
});

// Create a storage account with no public access
const storageAccount = new azure.storage.StorageAccount("storageAccount", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    networkRuleSet: {
        defaultAction: "Deny",
        bypass: "AzureServices",
    },
});

// Create a private endpoint for the storage account
const privateEndpoint = new azure.network.PrivateEndpoint("privateEndpoint", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    subnet: { id: subnet.id },
    privateLinkServiceConnections: [{
        name: "storageConnection",
        privateLinkServiceId: storageAccount.id,
        groupIds: ["blob"],
    }],
});

// Create a web app within the VNet
const appServicePlan = new azure.web.AppServicePlan("appServicePlan", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    sku: { name: "B1", tier: "Basic" },
});

const webApp = new azure.web.WebApp("webApp", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    serverFarmId: appServicePlan.id,
    siteConfig: {
        vnetRouteAllEnabled: true,
        ipSecurityRestrictions: [{
            ipAddress: "10.0.1.0/24",
            action: "Allow",
            priority: 100,
            name: "AllowSubnet",
        }],
    },
});

// Export the resource group and storage account names
export const resourceGroupName = resourceGroup.name;
export const storageAccountName = storageAccount.name;