Nimbus Cloud runs a network security perimeter (NSP) architecture and needs to include Platform-as-a-Service (PaaS) resources such as Azure Storage and Azure SQL in the perimeter. The security requirement is that all management plane and data-plane access to these PaaS services must either originate from the NSP hub or be blocked. Which approach ensures PaaS resources are associated with the NSP while allowing secure access from the hub?

Private Endpoints are the correct solution because they bring PaaS services into your private network, making them accessible only through your Azure VNet. By deploying Private Endpoints within the NSP hub or linked VNets, you ensure that all traffic (both management and data plane) to these PaaS resources traverses the NSP, satisfying the security requirement. Restricting public access on the PaaS resources further enhances security by eliminating external exposure. Service endpoints or routing configurations then direct traffic through the NSP hub. Enabling firewall rules on PaaS resources with public IPs is less secure as it still exposes the services publicly. Deploying PaaS resources inside VNets (VNet-injection) is not universally supported for all PaaS services and doesn't inherently enforce NSP traversal for all traffic. Using Azure Front Door is primarily for web application delivery and load balancing, not for integrating all PaaS services into a private network security perimeter.