Architecture · containment

The database is not in the subnet

Administrative bands hold the subscription and resource group. Traffic boxes hold the networks. Managed SQL and Key Vault sit in the group, not behind a subnet's rules — only their private endpoints do.

The database is not in the subnet Nested administrative bands hold two peered virtual networks; private endpoints sit inside a subnet while their managed database and vault sit outside every traffic boundary. SUBSCRIPTION RESOURCE GROUP VNET-HUB VNET-SPOKE SNET-APP SNET-PE PEERING SQL:1433 PRIVATE PRIVATE DB SQL managed KV Key Vault managed APP Checkout API snet-app PE PE · SQL snet-pe PE PE · Vault snet-pe LEGEND Admin band Traffic box Managed PaaS Private endpoint Workload

THE HEADLINE

The database is not in the subnet

SQL and Key Vault belong to the resource group. Packets reach them through private endpoints in the spoke subnet, not because the databases sit behind that subnet's rules.

What sits where

  • Checkout API in snet-app
  • Private endpoints in snet-pe
  • Hub and spoke joined by peering

Two shapes, two meanings

Dashed rx=4 bands are administrative. Solid rx=8 boxes are traffic. Greyscale still has to tell them apart.

checkout api · architecture containment example · schematic skill