> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Networking: VHub Peering

<Info>This connection option is only available for dedicated Astro clusters.</Info>

To set up a private connection between an Astro Virtual Network (VNet) and an Azure VHub, you can create a VHub peering connection. VHub peering ensures private and secure connectivity, reduces network transit costs, and attaches the Astro environment to a centralized managed network.

1. Retrieve the following information from the target Azure environment that you want to connect with:

   * Azure Tenant ID and Subscription ID.
   * VHub name.
   * Resource Group name.
   * Optional. Firewall IP address if you use any on the VHub side.

2. Prepare a `astro-vhub-peering-creator-role.json` JSON file with the following permissions. Replace `{customer-subscription-id}` with your value:

   ```json title="astro-vhub-peering-creator-role.json" wrap theme={null}
   {
       "Name": "Astro VHub Peering Contributor",
       "IsCustom": true,
       "Description": "Can create VNET peering with Astro.",
       "Actions": [
           "Microsoft.Resources/subscriptions/resourceGroups/read",
           "Microsoft.Resources/subscriptions/read",
           "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/write",
           "Microsoft.Network/virtualHubs/read",
           "Microsoft.Network/virtualWans/virtualHubs/read",
           "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/read"
       ],
       "NotActions": [

       ],
       "AssignableScopes": [
         "/subscriptions/{customer-subscription-id}"
       ]
   }
   ```

3. Run the following Azure CLI commands to give Astronomer Support temporary permissions to establish a VHub peering connection:

   ```sh wrap theme={null}
   # Add Astronomer Service Principal
   az ad sp create --id a67e6057-7138-4f78-bbaf-fd9db7b8aab0

   # Create a Custom role with permissions prepared in previous step
   az role definition create --role-definition ~/astro-vhub-peering-creator-role.json

   # Assign Custom role to the Astronomer Service Principal ({customer-subscription-id} has to be replaced with your value)
   az role assignment create \
   --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 \
   --role "Astro VHub Peering Contributor" \
   --scope "/subscriptions/{customer-subscription-id}"

   # Verify an assignment
   az role assignment list --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 --all -o table
   ```

4. Contact [Astronomer support](https://cloud.astronomer.io/open-support-request) to tell them that you granted them permissions to the Astronomer Service Principal. In addition, provide the following details in your request:

   * Astro Cluster ID
   * Azure Tenant ID and Subscription ID with a VHub
   * Resource group name
   * VHub name and preferable name for the peering
   * (Optional) Firewall IP address if you use any on the VHub side.

After receiving your request, Astronomer support creates a VHub peering connection to Astro VNet. No other actions are required from you. Astronomer support will notify you when the connection is ready to use.

When the network connection is confirmed, you can delete the temporary roles you created using the following command. Replace `{customer-subscription-id}` with your value:

```sh wrap theme={null}
az role assignment delete --assignee a67e6057-7138-4f78-bbaf-fd9db7b8aab0 --role "Astro VHub Peering Contributor" --scope "/subscriptions/{customer-subscription-id}"
```