A transit authority templates private endpoints for Key Vault used by fare-collection systems. What IaC security pattern is that?

Templating private endpoints for Key Vault used by fare-collection systems is an IaC security pattern that keeps civic PaaS secrets off the public network. Private endpoints place the Key Vault on the transit authority's virtual network address space so fare applications and automation reach secrets over private connectivity, typically with public network access disabled or tightly restricted. Encoding this in Bicep or Terraform ensures every fare Key Vault gets the same network posture—DNS integration (private DNS zone), NSG alignment, and diagnostic logging—without relying on engineers to remember portal steps under go-live pressure.

Using IaC to provision private endpoints that grant apps least-privilege managed identity vault rights misattributes an identity control to networking; private endpoints keep the vault off the public network but do not grant least-privilege RBAC, which still requires separate managed-identity role assignments. Least-privilege managed identity is useful for authorization, but provisioning a private endpoint does not create those vault permissions; network isolation from private endpoints and disabled public access does not replace separate identity controls for high-value civic secrets. Using IaC to provision private endpoints that add purge protection and soft-delete vault recovery confuses networking with data recovery; private endpoints provide network isolation but do not enable purge protection or soft-delete retention, which require separate vault recovery settings and alone do not keep fare secrets off the public network. Using IaC to provision private endpoints that forward vault diagnostic logs to the central SIEM system confuses networking with monitoring; private endpoints do not forward diagnostics to the SIEM, which requires separate diagnostic settings, and while logging supports detection after the fact, it is not the private-endpoint network isolation described.

Exam caveat: Private endpoints require DNS resolution that points to the private IP; misconfigured DNS is a common failure mode that looks like 'Key Vault is down' while traffic still tries the public endpoint. Also pair network isolation with RBAC, purge protection, soft delete, and managed identities—private networking alone does not replace identity controls.

Operational check: Confirm IaC deploys Key Vault private endpoints into the fare VNet/subnet, associates the privatelink DNS zone, disables or restricts public network access, grants apps managed-identity get permissions only on required secrets, and logs Key Vault diagnostics to the transit Log Analytics workspace for access auditing.