Private DNS Zone should be linked to at least one virtual network

High Azure General privatednszones-private-dns-zone-linked

Applies to

Microsoft.Network/privateDnsZones

What CGPulse checks

A resource passes this rule when virtualNetworkLinksCount must be greater than 0. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Link the Private DNS Zone to at least one VNet to enable DNS resolution for private endpoints. In Azure Portal: Private DNS Zone > Virtual network links > Add. See: https://learn.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links

CLI

az network private-dns link vnet create -g "{rg}" -z "{name}" -n "{name}-vnet-link" -v "<vnet-id>" -e false

Bicep

resource dnsLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = {
  name: '{name}-vnet-link'
  parent: privateDnsZone
  location: 'global'
  properties: {
    virtualNetwork: { id: '<vnet-resource-id>' }
    registrationEnabled: false
  }
}

Terraform

resource "azurerm_private_dns_zone_virtual_network_link" "{name}" {
  name                  = "{name}-vnet-link"
  resource_group_name   = "{rg}"
  private_dns_zone_name = azurerm_private_dns_zone.{name}.name
  virtual_network_id    = "<vnet-id>"
  registration_enabled  = false
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan