Two App Services: front web app with VNet injection and back web app with a private endpoint

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set azure-ts-webapp-privateendpoint-vnet-injection
$ cd pulumi-examples/azure-ts-webapp-privateendpoint-vnet-injection

This deploys a secure front end - back end web app. The front end web app is plugged in a subnet with the feature regional VNet integration enabled. Settings are set to consume a DNS private zone. The backend web app is only exposed through a private endpoint.

It will create a VNet, two subnets, one where your Private Endpoint will exist, the second where you will inject the front web app, an App Service Plan in PremiumV2 tier (mandatory for Private Endpoint), a Private Endpoint, settings for DNS queries to the DNS Private Zone, and a private DNS zone with record for the Private Endpoint.

Prerequisites#

1. Install Pulumi
2. Configure Azure credentials
3. Install Node.js

Deploying the example#

1. Create a new stack, which is an isolated deployment target for this example:

   pulumi stack init dev

2. Set the Azure region to deploy into:

   pulumi config set azure-native:location westus2

3. Optionally, override the default CIDR ranges:

   pulumi config set virtualNetworkCIDR 10.200.0.0/16   # CIDR range for the VNet
   pulumi config set backendCIDR 10.200.1.0/24          # subnet CIDR range for the backend
   pulumi config set frontendCIDR 10.200.2.0/24         # subnet CIDR range for the frontend

4. Install dependencies:

   npm install

5. Deploy the stack:

   pulumi up

Cleaning up#

Once you’re finished experimenting, tear down your stack’s resources by destroying and removing it:

pulumi destroy
pulumi stack rm