Azure Databricks閉域網にVPNでアクセスしてみた


#### システム構成
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/66e36f27-2d2a-ee1b-2f51-a50787f73388.png)

## 概要

DatabricksをVNETインジェクションで構成し、公衆ネットワーク アクセスを許可せずに内部のプライベートエンドポイント経由でVPNを使用してアクセスを行います。


サブネットは、①VPN作成時に必要なGatewaySubnet、②③はDNS Private Resolverに必要なinboundとoutboundに使用、④はdatabricksに必要なプライベートエンドポイントポイントを置くためにあります。

VPNからポイント対サイトで資格証明書を持っているクライアントPCからのみアクセス出来るようにします。

まとめると、特定の証明書をインストールしたPCからVPNを起動するとDatabricksにアクセス出来る手順を以下に記載させて頂きます。

## 構築

今回画面操作で構築すると時間が掛かるのでBicepでデプロイを行います。
以下に解説の記事を書いています。

https://qiita.com/ShogoMatsumoto/items/a66234b27ee29a2f4c08

#### Databricksのデプロイ
databricksのARMはMicrosoftが公開しているものがあるので、Bicepにデコンパイルします。

https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.databricks

以下デコンパイルして修正したものになります。
ローカル環境でbicepファイルを作成し内容をコピーします。

```bicep:DatabricksDeploy.bicep
//secure cluster connectivity (SCC) を設定
var  disablePublicIp = true
var  location = 'japaneast'
var  nsgName = 'databricks-nsg'
var  pricingTier = 'premium'
var  privateSubnetCidr = '10.179.0.0/18'
var  privateSubnetName = 'private-subnet'
//公共アクセスを無効化
var  publicNetworkAccess = 'Disabled'
var  publicSubnetCidr = '10.179.64.0/18'
var  privateEndpointSubnetCidr = '10.179.128.0/24'
var  publicSubnetName = 'public-subnet'
var  requiredNsgRules = 'NoAzureDatabricksRules'
var  vnetCidr = '10.179.0.0/16'
var  vnetName = 'databricks-vnet'
var  workspaceName = 'default'
var managedResourceGroupName = 'databricks-rg-${workspaceName}-${uniqueString(workspaceName, resourceGroup().id)}'
var PrivateEndpointSubnetName = 'default'
var private_endpoint_name_ui_api = '${workspaceName}-pvtEndpoint-ui-api'
var private_endpoint_name_browser = '${workspaceName}-pvtEndpoint-broweser'
var privateDnsZoneName = 'privatelink.azuredatabricks.net'

resource nsg 'Microsoft.Network/networkSecurityGroups@2021-03-01' = {
  name: nsgName
  location: location
  properties: {
    securityRules: [
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-worker-inbound'
        properties: {
          description: 'Required for worker nodes communication within a cluster.'
          protocol: '*'
          sourcePortRange: '*'
          destinationPortRange: '*'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'VirtualNetwork'
          access: 'Allow'
          priority: 100
          direction: 'Inbound'
        }
      }
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-databricks-webapp'
        properties: {
          description: 'Required for workers communication with Databricks Webapp.'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '443'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'AzureDatabricks'
          access: 'Allow'
          priority: 100
          direction: 'Outbound'
        }
      }
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-sql'
        properties: {
          description: 'Required for workers communication with Azure SQL services.'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '3306'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'Sql'
          access: 'Allow'
          priority: 101
          direction: 'Outbound'
        }
      }
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-storage'
        properties: {
          description: 'Required for workers communication with Azure Storage services.'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '443'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'Storage'
          access: 'Allow'
          priority: 102
          direction: 'Outbound'
        }
      }
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-worker-outbound'
        properties: {
          description: 'Required for worker nodes communication within a cluster.'
          protocol: '*'
          sourcePortRange: '*'
          destinationPortRange: '*'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'VirtualNetwork'
          access: 'Allow'
          priority: 103
          direction: 'Outbound'
        }
      }
      {
        name: 'Microsoft.Databricks-workspaces_UseOnly_databricks-worker-to-eventhub'
        properties: {
          description: 'Required for worker communication with Azure Eventhub services.'
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '9093'
          sourceAddressPrefix: 'VirtualNetwork'
          destinationAddressPrefix: 'EventHub'
          access: 'Allow'
          priority: 104
          direction: 'Outbound'
        }
      }
    ]
  }
}

resource vnet 'Microsoft.Network/virtualNetworks@2021-08-01' = {
  name: vnetName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        vnetCidr
      ]
    }
    subnets: [
      {
        name: publicSubnetName
        properties: {
          addressPrefix: publicSubnetCidr
          networkSecurityGroup: {
            id: nsg.id
          }
          delegations: [
            {
              name: 'databricks-del-public'
              properties: {
                serviceName: 'Microsoft.Databricks/workspaces'
              }
            }
          ]
        }
      }
      {
        name: privateSubnetName
        properties: {
          addressPrefix: privateSubnetCidr
          networkSecurityGroup: {
            id: nsg.id
          }
          delegations: [
            {
              name: 'databricks-del-private'
              properties: {
                serviceName: 'Microsoft.Databricks/workspaces'
              }
            }
          ]
        }
      }
      {
        name: PrivateEndpointSubnetName
        properties: {
          addressPrefix: privateEndpointSubnetCidr
          privateEndpointNetworkPolicies: 'Disabled'
        }
      }
    ]
  }
}

resource workspace 'Microsoft.Databricks/workspaces@2021-04-01-preview' = {
  name: workspaceName
  location: location
  sku: {
    name: pricingTier
  }
  properties: {
    managedResourceGroupId: subscriptionResourceId('Microsoft.Resources/resourceGroups', managedResourceGroupName)
    parameters: {
      customVirtualNetworkId: {
        value: vnet.id
      }
      customPublicSubnetName: {
        value: publicSubnetName
      }
      customPrivateSubnetName: {
        value: privateSubnetName
      }
      enableNoPublicIp: {
        value: disablePublicIp
      }
    }
    publicNetworkAccess: publicNetworkAccess
    requiredNsgRules: requiredNsgRules
  }
}

resource pe_ui 'Microsoft.Network/privateEndpoints@2021-08-01' = {
  name: private_endpoint_name_ui_api
  location: location
  properties: {
    subnet: {
      id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, PrivateEndpointSubnetName)
    }
    privateLinkServiceConnections: [
      {
        name: private_endpoint_name_ui_api
        properties: {
          privateLinkServiceId: '${resourceGroup().id}/providers/Microsoft.Databricks/workspaces/${workspaceName}'
          groupIds: [
            'databricks_ui_api'
          ]
        }
      }
    ]
  }
  dependsOn: [
    workspace
  ] 
}


resource pe_browser 'Microsoft.Network/privateEndpoints@2021-08-01' = {
  name: private_endpoint_name_browser 
  location: location
  properties: {
    subnet: {
      id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, PrivateEndpointSubnetName)
    }
    privateLinkServiceConnections: [
      {
        name: private_endpoint_name_browser 
        properties: {
          privateLinkServiceId: '${resourceGroup().id}/providers/Microsoft.Databricks/workspaces/${workspaceName}'
          groupIds: [
            'browser_authentication'
          ]
        }
      }
    ]
  }
  dependsOn: [
    pe_ui
  ] 
}





resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: privateDnsZoneName
  location: 'global'
  dependsOn: [
    pe_ui
  ]
}

resource privateDnsZoneName_privateDnsZoneName_link 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
  parent: privateDnsZone
  name: '${privateDnsZoneName}-link'
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: vnet.id
    }
  }
}



resource privateEndpoints_test2_name_default 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2022-05-01' = {
  name: '${pe_ui.name}/default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'privatelink_azuredatabricks_net'
        properties: {
          privateDnsZoneId: privateDnsZone.id
        }
      }
    ]
  }
  dependsOn: [
    pe_ui
  ]
}

resource privateEndpoints_jwits_test_pvtEndpoint_name_mydnsgroupname 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2022-05-01' = {
  name: '${pe_browser.name}/default2'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'config1'
        properties: {
          privateDnsZoneId: privateDnsZone.id
        }
      }
    ]
  }
  dependsOn: [
    pe_browser
  ]
}

```

`az login`した後に

`az deployment group create --resource-group デプロイリソースグループ --template-file DatabricksDeploy.bicepのファイルパス`

を実行します。

デプロイの進捗はリソースグループのデプロイから確認が出来ます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/2fdadc90-ff2b-4a52-6822-0e8fd59ce212.png)

リソースの展開を確認。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/eccdbc73-49d9-2469-1b4b-fed10dae565a.png)



公共からのアクセスを無効にしているため、アクセス出来ないことが確認できます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/71e645e0-f911-1815-d021-f1550b4bc2a7.png)

### VPNのデプロイ

次にVirtualNetworkGateway(VPN)をデプロイしていきます。

##### 証明書発行
PowerShellで下記コマンドからルート証明書を生成して、****ウインドウを閉じないまま****にしておきます。

```
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign
```

実行後、検索欄で「certmgr.msc」を検索してクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/5196ad4d-74f8-e39a-2c0d-0ba9becfb1a5.png)

「個人」→「証明書」をクリックし、生成された証明書を確認します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/a7b9dd2a-0d44-41ac-3875-a46a2944ad6b.png)

先程のPowerShellを実行した画面で下記コマンドを実行します。

```
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
```

更新コマンドをクリックし、クライアント証明書が生成されているのを確認します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/6a3851b8-49c2-6001-ed67-60056faa8460.png)

PS2RootCertを右クリックし、「すべてのタスク」→「エクスポート」をクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/feed6dce-b33c-8939-b01c-f3960cc64539.png)

「次へ」をクリックします。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/7219c8d1-e837-7c51-70cf-f80a4b5410f4.png)

「いいえ」を選択します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/e30dd1e4-3fee-eb28-6121-bffd9c579a04.png)

「Base64エンコード」を選択します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/e60ae311-dbb2-8327-f119-8945a5aaf0ae.png)

出力先のパスを任意で選択します。
![cert.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/83152106-4f7d-4ef9-9405-04ac63f9e1c5.png)



![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/e4372ed3-c995-3e74-cc65-b6519c834e02.png)

エクスポートされたファイルをテキストエディターで開きます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/ecac7cdd-67ae-c810-578b-9ab44446ace8.png)


-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
を除く文字列を下記にあるVpnDeploy.bicepのvpn_certification変数にセットします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/94b0793c-8b94-1ef2-9ae9-048a0d31b7ab.png)


セット後、下記のVpnDeploy.bicepをデプロイします。
完了までに時間が掛かるので注意が必要です。

```bicep:VpnDeploy.bicep
//生成したルート証明書
var vpn_certification = ''

var vnet_name = 'databricks-vnet'
var location = 'japaneast'
var gateway_subnet_cidr = '10.179.255.0/24'
var vpn_gateway_cidr = '172.16.1.0/24'
var vpn_certification_name = 'クライアントルート証明書'

resource vnet 'Microsoft.Network/virtualNetworks@2022-07-01' existing = {
  name: vnet_name
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' = {
  name: 'GatewaySubnet'
  parent: vnet
  properties: {
    addressPrefix: gateway_subnet_cidr
    delegations: []
  }

}

resource public 'Microsoft.Network/publicIPAddresses@2022-07-01' = {
  name: 'gateway_ip'
  location: location
}

resource gateway 'Microsoft.Network/virtualNetworkGateways@2020-07-01' = {
  name: 'vpn'
  location: location
  properties: {
    gatewayType: 'vpn'
    vpnGatewayGeneration: 'Generation1'
    vpnType: 'RouteBased'
    sku: {
      name: 'VpnGw1'
      tier: 'VpnGw1'
    }
    ipConfigurations: [
      {
        name: 'GatewayConfig'
        properties: {
          subnet: {
            id: '${vnet.id}/subnets/GatewaySubnet'
          }
          publicIPAddress: {
            id: public.id
          }
        }
      }
    ]
    vpnClientConfiguration: {
      vpnClientAddressPool: {
        addressPrefixes: [
          vpn_gateway_cidr
        ]
      }
      vpnClientProtocols: [
        'IkeV2'
      ]
      vpnAuthenticationTypes: [
        'Certificate'
      ]
      vpnClientRootCertificates: [
        {
          name: vpn_certification_name
          properties: {
            publicCertData: vpn_certification
          }
        }
      ]
    }
  }
  dependsOn: [
    public
    subnet
  ]
}

```

##### VPN設定
デプロイ完了後に、「vpn」という名前の仮想ゲートウェイをクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/ee69f241-e960-3e96-53ec-cd7e286cc3d8.png)


左欄から「ポイント対サイトの構成」をクリックし、「VPNクライアントのダウンロード」をクリックします。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/cfde6526-250b-12df-6d82-7362d473cb15.png)

ダウンロードして解凍すると以下ファイルが含まれています。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/dac43234-eace-3470-f238-358dba2784f8.png)

VpnSettings.xmlの<VpnServer></VpnServer>で囲まれている部分を以下のVPN接続情報にセットして作成します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/476419a6-93c3-ffa1-7f5c-8e249445dcc3.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/7712d43f-9444-30a2-15ee-acfa3b809c75.png)


![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/a26c0d19-6570-b5b8-0a8c-a73108844943.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/174903a8-23fd-4023-77a1-adacdb0dadfe.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/3387cfac-a07f-b16e-453b-9bdb07f02d93.png)



これでVPNに接続出来ている状態になりました。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/4a1cab0b-fd1c-b0d3-9b32-1bd090a5e76e.png)



### DNS Private Resolverのデプロイ
最後にdatabricksがDNSを解決出来るように、DNS Private Resolverをデプロイします。

まずリソース一覧から「privatelink.azuredatabricks.net」をクリックします。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/8aeb031f-3c10-bfa1-e936-2f6eb67095a5.png)

画像では「adb-5113875134185442.2」、「10.179.128.4」となっていますが、この部分はdatabricksデプロイ時にランダムで割り当てられます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/6fdba77f-5c14-3b80-4b49-bf88b97642c2.png)

下記のResolverDeploy.bicepのDomainName変数に「adb-5113875134185442.2.」、targetDNSのingressに「10.179.128.4」を例としてセットします。

※ドメイン後ろに.を追加してそれぞれの環境で確認した値をセットしてください。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/fc99446c-4e1a-19a6-3b15-6ec8d0239ac4.png)


以下ファイルを変数セット後デプロイします。

```bicep:ResolverDeploy.bicep
//Databricksドメイン設定
var DomainName = ''
//DatabricksのプライベートIp設定
var targetDNS = [
  {
    ipaddress: ''
    port: 53
  }
]


var resolverVNETName = 'databricks-vnet'
var dnsResolverName = 'dnsResolver'
var location = 'japaneast'
var inboundSubnet = 'inbound'
var inboundAddressPrefix = '10.179.129.0/24'
var outboundSubnet = 'outbound'
var outboundAddressPrefix = '10.179.130.0/24'
var resolvervnetlink = 'vnetlink'
var forwardingRulesetName = 'forwardingRule'
var forwardingRuleName = 'routing_databricks'

resource vnet 'Microsoft.Network/virtualNetworks@2022-07-01' existing = {
  name: resolverVNETName
}

resource subnet1 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' = {
  name: inboundSubnet
  parent: vnet
  properties: {
    addressPrefix: inboundAddressPrefix
    delegations: [
      {
        name: 'Microsoft.Network.dnsResolvers'
        properties: {
          serviceName: 'Microsoft.Network/dnsResolvers'
        }
        type: 'Microsoft.Network/virtualNetworks/subnets/delegations'
      }
    ]
  }
  dependsOn: [
    vnet
  ]
}

resource subnet2 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' = {
  name: outboundSubnet
  parent: vnet
  properties: {
    addressPrefix: outboundAddressPrefix
    delegations: [
      {
        name: 'Microsoft.Network.dnsResolvers'
        properties: {
          serviceName: 'Microsoft.Network/dnsResolvers'
        }
        type: 'Microsoft.Network/virtualNetworks/subnets/delegations'
      }
    ]
  }
  dependsOn: [
    vnet
    subnet1
  ]
}

resource resolver 'Microsoft.Network/dnsResolvers@2022-07-01' = {
  name: dnsResolverName
  location: location
  properties: {
    virtualNetwork: {
      id: vnet.id
    }
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

resource inEndpoint 'Microsoft.Network/dnsResolvers/inboundEndpoints@2022-07-01' = {
  parent: resolver
  name: inboundSubnet
  location: location
  properties: {
    ipConfigurations: [
      {
        privateIpAllocationMethod: 'Dynamic'
        subnet: {
          id: '${vnet.id}/subnets/${inboundSubnet}'
        }
      }
    ]
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

resource outEndpoint 'Microsoft.Network/dnsResolvers/outboundEndpoints@2022-07-01' = {
  parent: resolver
  name: outboundSubnet
  location: location
  properties: {
    subnet: {
      id: '${vnet.id}/subnets/${outboundSubnet}'
    }
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

resource fwruleSet 'Microsoft.Network/dnsForwardingRulesets@2022-07-01' = {
  name: forwardingRulesetName
  location: location
  properties: {
    dnsResolverOutboundEndpoints: [
      {
        id: outEndpoint.id
      }
    ]
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

resource resolverLink 'Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks@2022-07-01' = {
  parent: fwruleSet
  name: resolvervnetlink
  properties: {
    virtualNetwork: {
      id: vnet.id
    }
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

resource fwRules 'Microsoft.Network/dnsForwardingRulesets/forwardingRules@2022-07-01' = {
  parent: fwruleSet
  name: forwardingRuleName
  properties: {
    domainName: DomainName
    targetDnsServers: targetDNS
  }
  dependsOn: [
    vnet
    subnet1
    subnet2
  ]
}

```
##### DNS設定

問い合わせ先のDNS設定を行います。
ネットワークからdatabricks_vnetを右クリックして「プロパティ」を選択します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/d43ca772-3734-4bb4-41cc-62317dcc2ff9.png)

「ネットワーク」から「インターネットプロトコルバージョン4」を選択し、「プロパティ」をクリックします。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/29192d3c-858b-44f4-d839-43b4ed38471d.png)

下記の優先DNSにデプロイした***DNS Private Resolverの受信エンドポイントのIP***を以下に記載します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/c257c94c-9ea3-71f4-5674-9c332a67c715.png)

##### Databricks確認

デプロイ完了後、「defafult」のDatabricksをクリックし、画面からURLを選択します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/e63bc034-42c1-dd07-d1b6-9c9bb2b027a4.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/ff69a0cb-6254-69f5-22f5-c4867cf63ede.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/fa6e6c0d-4a35-fed4-eb7e-b1c9f62e7b6b.png)

無事ログイン出来ることを確認。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/fc2d7741-0949-8de8-9a45-7cf74ad9e096.png)

クラスターも無事作成出来ました。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2752288/c7daaed4-d656-2956-8168-0838a066a4f9.png)



### 参考にしたサイト様

https://learn.microsoft.com/ja-jp/azure/dns/dns-private-resolver-get-started-bicep?tabs=CLI

https://learn.microsoft.com/ja-jp/azure/templates/microsoft.network/virtualnetworkgateways?pivots=deployment-language-bicep

https://learn.microsoft.com/ja-jp/azure/vpn-gateway/vpn-gateway-certificates-point-to-site#clientcert

これで以上となります。
見て下さりありがとうございました。