<p>I figured this out, most likely a lack of understanding on my part, but after some reading I have figured out where I went wrong.</p>
<p>Basically, you <em>HAVE</em> to have a private DNS zone for mysql servers with the exact name <code>privatelink.mysql.database.azure.com</code> created, and you can use that id.</p>
<p>I had a private DNS zone already, but I didn't understand that it was <em>tied</em> to AKS stuff. I <em>HAD</em> to create it with the name <code>private.uksouth.azmk8s.io</code> and I didn't realise that the <code>azmk8s</code> is the azure short hand for the &quot;azure kubernetes service DNS zone&quot; and just saw that it was a private DNS zone in UK south and assumed it would be fine.</p>
<p>You need a private DNS zone &quot;of specific name type&quot; per product it seems. As you can only associate one private DNS zone &quot;of a named type&quot; to any one VNet, if, like me, you are doing a hub/spoke model. I found that creating my private DNS zones in my hub vnet, then peering that vnet to my spoke one, then associating the private DNS zone to the peered spoke vnet as well as the hub vnet allows this to work for me.</p>
<p>All my services will need individual names within the private DNS, but it means that my hub, and everything in the peered vnet can access the services (in this instance mysql flexible server) by the private DNS address.</p>
<p>I hope that makes sense, and helps anyone else that comes across this.</p>

CC BY-SA 4.0
2024-10-31T08:19:19.617Z
2024-10-31T08:19:19.617Z
Mark McGookin
<p>I am trying to use this code:</p>
<pre><code>resource &quot;azurerm_mysql_flexible_server&quot; &quot;shared&quot; {
  name                   = var.mysql_server_name
  resource_group_name    = azurerm_resource_group.shared.name
  location               = azurerm_resource_group.shared.location
  administrator_login    = var.mysql_server_admin_username
  administrator_password = random_password.sql_server.result
  backup_retention_days  = 7
  delegated_subnet_id    = azurerm_subnet.database.id
  private_dns_zone_id    = var.ops_private_dns_zone_id
  sku_name               = var.mysql_sku
  depends_on             = [azurerm_private_dns_zone_virtual_network_link.ops_link]
  tags                   = var.tags
}
</code></pre>
<p>To create a mysql flexible server, we have a private DNS zone in a hub vnet and from there we peer out to many spokes, this being one of them. All the other services have no issue connecting to the Private DNS Zone (things like AKS clusters etc) but no matter what name I choose, I just get this error every time</p>
<pre><code>Status: &quot;InvalidPrivateDnsZoneName&quot;
│ Code: &quot;&quot;
│ Message: &quot;The Private DNS Zone name provided is invalid. It must end with 'mysql.database.azure.com', and shouldn't contain underscore. Currently we do not support anything.mysql.database.azure.com as the private dns zone name either.&quot;
│ Activity Id: &quot;&quot;
│ 
│ ---
│ 
│ API Response:
│ 
│ ----[start]----
│ {&quot;name&quot;:&quot;c7ec66bb-2d21-47d9-a43b-69528025a220&quot;,&quot;status&quot;:&quot;Failed&quot;,&quot;startTime&quot;:&quot;2024-10-29T16:22:40.423Z&quot;,&quot;error&quot;:{&quot;code&quot;:&quot;InvalidPrivateDnsZoneName&quot;,&quot;message&quot;:&quot;The Private DNS Zone name provided is invalid. It must end with 'mysql.database.azure.com', and shouldn't contain underscore. Currently we do not support anything.mysql.database.azure.com as the private dns zone name either.&quot;}}
│ -----[end]-----
</code></pre>
<p>I have tried <code>with-hyphens</code> and <code>without</code> <code>shrt</code> <code>reallylongIncaseSomethingIsClashing</code> and no matter what I get that same error every time. The value I am providing for the private dns zone id is the exact value I use in other places and they all work fine.</p>
<p>Any insight into this would be amazing, as you have to provide a private DNS zone id if you delegate to a subnet, and as this all has to be secure I need it on that subnet so that I can access it via a jumpbox.</p>
<p>It's the <code>we do not support anything.mysql.database.azure.com as the private dns zone name either</code> that is really the kicker as it shows that it ends with <code>mysql.database.azure.com</code> so that's clearly fine, there's no underscore and just no more information</p>

<terraform><azure><dns><mysql>
Unable to create azurerm_mysql_flexible_server in azure with terraform due to private dns zone errors "The Private DNS Zone name provided is invalid"
Mark McGookin
# Unable to create azurerm_mysql_flexible_server in azure with terraform due to private dns zone errors "The Private DNS Zone name provided is invalid"

(Asked by: username_0 on 2024-10-29)

I am trying to use this code:
resource "azurerm_mysql_flexible_server" "shared" {
  name                   = var.mysql_server_name
  resource_group_name    = azurerm_resource_group.shared.name
  location               = azurerm_resource_group.shared.location
  administrator_login    = var.mysql_server_admin_username
  administrator_password = random_password.sql_server.result
  backup_retention_days  = 7
  delegated_subnet_id    = azurerm_subnet.database.id
  private_dns_zone_id    = var.ops_private_dns_zone_id
  sku_name               = var.mysql_sku
  depends_on             = [azurerm_private_dns_zone_virtual_network_link.ops_link]
  tags                   = var.tags
}

To create a mysql flexible server, we have a private DNS zone in a hub vnet and from there we peer out to many spokes, this being one of them. All the other services have no issue connecting to the Private DNS Zone (things like AKS clusters etc) but no matter what name I choose, I just get this error every time
Status: "InvalidPrivateDnsZoneName"
│ Code: ""
│ Message: "The Private DNS Zone name provided is invalid. It must end with 'mysql.database.azure.com', and shouldn't contain underscore. Currently we do not support anything.mysql.database.azure.com as the private dns zone name either."
│ Activity Id: ""
│ 
│ ---
│ 
│ API Response:
│ 
│ ----[start]----
│ {"name":"c7ec66bb-2d21-47d9-a43b-69528025a220","status":"Failed","startTime":"2024-10-29T16:22:40.423Z","error":{"code":"InvalidPrivateDnsZoneName","message":"The Private DNS Zone name provided is invalid. It must end with 'mysql.database.azure.com', and shouldn't contain underscore. Currently we do not support anything.mysql.database.azure.com as the private dns zone name either."}}
│ -----[end]-----

I have tried with-hyphens and without shrt reallylongIncaseSomethingIsClashing and no matter what I get that same error every time. The value I am providing for the private dns zone id is the exact value I use in other places and they all work fine.
Any insight into this would be amazing, as you have to provide a private DNS zone id if you delegate to a subnet, and as this all has to be secure I need it on that subnet so that I can access it via a jumpbox.
It's the we do not support anything.mysql.database.azure.com as the private dns zone name either that is really the kicker as it shows that it ends with mysql.database.azure.com so that's clearly fine, there's no underscore and just no more information

**Tags:** terraform, azure, dns, mysql


---

## 1 answers

### Answer by username_0 on 2024-10-31. Score: 0 | Accepted answer

I figured this out, most likely a lack of understanding on my part, but after some reading I have figured out where I went wrong.

Basically, you *HAVE* to have a private DNS zone for mysql servers with the exact name `privatelink.mysql.database.azure.com` created, and you can use that id.

I had a private DNS zone already, but I didn't understand that it was *tied* to AKS stuff. I *HAD* to create it with the name `private.uksouth.azmk8s.io` and I didn't realise that the `azmk8s` is the azure short hand for the "azure kubernetes service DNS zone" and just saw that it was a private DNS zone in UK south and assumed it would be fine.

You need a private DNS zone "of specific name type" per product it seems. As you can only associate one private DNS zone "of a named type" to any one VNet, if, like me, you are doing a hub/spoke model. I found that creating my private DNS zones in my hub vnet, then peering that vnet to my spoke one, then associating the private DNS zone to the peered spoke vnet as well as the hub vnet allows this to work for me.

All my services will need individual names within the private DNS, but it means that my hub, and everything in the peered vnet can access the services (in this instance mysql flexible server) by the private DNS address.

I hope that makes sense, and helps anyone else that comes across this.


---

