Skip to content

Commit 19493b9

Browse files
denreadenrea
authored
Merge pull request #178012 from IngridAtMicrosoft/privatelink2
Private Link Starting Over Again
2 parents 5986b23 + c4c56a9 commit 19493b9

6 files changed

+252
-9
lines changed

‎.openpublishing.redirection.media-services.json

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,12 @@
619619
"source_path_from_root": "/articles/media-services/video-indexer/index.yml",
620620
"redirect_url": "/azure/azure-video-analyzer/video-analyzer-for-media-docs",
621621
"redirect_document_id": false
622-
},
622+
},
623+
{
624+
"source_path_from_root": "/articles/media-services/latest/security-private-link-how-to.md",
625+
"redirect_url": "/azure/media-services/latest/security-private-link-arm-how-to",
626+
"redirect_document_id": false
627+
},
623628
{
624629
"source_path_from_root": "/articles/media-services/latest/latest/questions-collection.md",
625630
"redirect_url": "/articles/media-services/latest/frequently-asked-questions.yml",

‎articles/media-services/latest/TOC.yml

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -371,9 +371,10 @@
371371
displayName: trusted storage, storage, access, storage access, security
372372
- name: Network security
373373
items:
374-
- name: Create a Media Services and Storage account with a Private Link
375-
href: security-private-link-how-to.md
376-
displayName: security, private link, links, firewall, storage account, storage, private, links, secure
374+
- name: Private endpoint connections
375+
href: security-private-link-connect-private-endpoint-concept.md
376+
- name: Private Link with Azure Media Services
377+
href: security-private-link-concept.md
377378
- name: Key delivery IP allowlist
378379
href: drm-content-protection-key-delivery-ip-allow.md
379380
displayName: DRM, AES, content key, allow list, IP, whitelist, access control, IP allow list, IP restriction, key delivery, license delivery, AES Key, AES-128, common encryption, security, secure, protect, encrypt
@@ -621,8 +622,10 @@
621622
href: ../../active-directory/managed-identities-azure-resources/howto-assign-access-portal.md
622623
- name: Network security
623624
items:
624-
- name: How to use Private Link with a media and storage account
625-
href: security-private-link-how-to.md
625+
- name: Use a Private Link with a Streaming endpoint
626+
href: security-private-link-streaming-endpoint-how-to.md
627+
- name: How to use Private Link with and ARM template
628+
href: security-private-link-arm-how-to.md
626629
displayName: security, private link, links, firewall, storage account, storage, private, links, secure
627630
- name: Secure streaming
628631
items:

‎articles/media-services/latest/security-private-link-how-to.md renamed to ‎articles/media-services/latest/security-private-link-arm-how-to.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Create a Media Services and Storage account with a private link
3-
titleSuffix: Media Services
2+
title: Create a Media Services and Storage account with a private link using an ARM template
3+
titleSuffix: Azure Media Services
44
description: Create a Media Services account and Storage Account with Private Links to a VNet. The Azure Resource Manager (ARM) template also sets up DNS for both the Private Links. Finally the template creates a VM to allow the user to try out the Private Links.
55
services: media-services
66
author: IngridAtMicrosoft
@@ -11,7 +11,7 @@ ms.date: 04/15/2021
1111
ms.author: inhenkel
1212
---
1313

14-
# Create a Media Services and Storage account with a Private Link
14+
# Create a Media Services and Storage account with a Private Link using an ARM template
1515

1616
[!INCLUDE [media services api v3 logo](./includes/v3-hr.md)]
1717

‎articles/media-services/latest/security-private-link-concept.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: Overview of using private links with Azure Media Services
3+
description: This article gives an overview of using private links with Azure Media Services.
4+
services: media-services
5+
author: IngridAtMicrosoft
6+
manager: femila
7+
ms.service: media-services
8+
ms.topic: conceptual
9+
ms.date: 10/22/2021
10+
ms.author: inhenkel
11+
---
12+
13+
# Overview of using Azure Private Link with Azure Media Services
14+
15+
[!INCLUDE [media services api v3 logo](./includes/v3-hr.md)]
16+
17+
This article gives an overview of using private links with Azure Media Services.
18+
19+
## When to use Private Link with Media Services
20+
21+
Private Link allows Media Services to be accessed from private networks. When used with the network access controls provided by Media Services, private links can enable Media Services to be used without exposing endpoints to the public internet.
22+
23+
## Azure Private Endpoint and Azure Private Link
24+
25+
An [Azure Private Endpoint](/private-link/private-endpoint-overview) is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service via Azure Private Link.
26+
27+
Media Services endpoints may be accessed from a virtual network using private endpoints. Private endpoints may also be accessed from peered virtual networks or other networks connected to the virtual network using Express Route or VPN.
28+
29+
[Azure Private Links](/private-link/) allow access to Media Services private endpoints in your virtual network without exposing them to the public Internet. It routes traffic over the Microsoft backbone network.
30+
31+
## Restricting access
32+
33+
> [!Important]
34+
> Creating a private endpoint **DOES NOT** implicitly disable internet access to it.
35+
36+
Internet access to the endpoints in the Media Services account can be restricted in one of two ways:
37+
38+
- Restricting access to all resources within the Media Services account.
39+
- Restricting access separately for each resource by using the IP allowlist.
40+
41+
## Media Services endpoints
42+
43+
| Endpoint | Description | Supports private link | Internet access control |
44+
| --------------------------- | ------------------------------------------------------------------------- | --------------------- | ----------------------- |
45+
| Streaming Endpoint | The origin server for streaming video and formats media into HLS and DASH | Yes | IP allowlist |
46+
| Streaming Endpoint with CDN | Stream media to many viewers | No | Managed by CDN |
47+
| Key Delivery | Provides media content keys and DRM licenses to media viewers | Yes | IP allowlist |
48+
| Live event | Ingests media content for live streaming | Yes | IP allowlist |
49+
50+
> [!NOTE]
51+
> Media Services accounts created with API versions prior to 2020-05-01 also have an endpoint for the legacy RESTv2 API endpoint (pending deprecation). This endpoint does not support private links.
52+
53+
## Other Private Link enabled Azure services
54+
55+
| Service | Media Services integration | Private link documentation |
56+
| ---------------------- | ----------------------------------------------- | -------------------------- |
57+
| Azure Storage | Used to store media | [Use private endpoints for Azure Storage](/storage/common/storage-private-endpoints) |
58+
| Azure Key Vault | Used to store [customer managed keys](security-customer-managed-keys-portal-tutorial.md) | [Configure Azure Key Vault networking settings](/key-vault/general/how-to-azure-key-vault-network-security) |
59+
| Azure Resource Manager | Provides access to Media Services APIs | [Use REST API to create private link for managing Azure resources](/azure-resource-manager/management/create-private-link-access-rest) |
60+
| Event Grid | Provides [notifications of Media Services events](./monitoring/job-state-events-cli-how-to.md) | [Configure private endpoints for Azure Event Grid topics or domains](/event-grid/configure-private-endpoints) |
61+
62+
## Private endpoints are created on the Media Services account
63+
64+
Private Endpoints for Key Delivery, Streaming Endpoints, and Live Events are created on the Media Services account instead of being created individually.
65+
66+
A private IP address is created for each Streaming Endpoint or Live Event in the Media Services account when a Media Services private endpoint resource is created. For example, if you have two started Streaming Endpoints, a single private endpoint should be created to connect both Streaming Endpoints to a virtual network. Resources can be connected to multiple virtual networks at the same time.
67+
68+
Internet access to the Media Services account should be restricted, either for all the resources within the account or separately for each resource.
69+
70+
## Private Link pricing
71+
For pricing details, see [Azure Private Link Pricing](https://azure.microsoft.com/pricing/details/private-link)
72+
73+
## Private Link how-tos and FAQs
74+
75+
- [Create a Media Services and Storage account with a Private Link using an Azure Resource Management template](security-private-link-arm-how-to.md)
76+
- [Create a Private Link for a Streaming Endpoint](security-private-link-streaming-endpoint-how-to.md)

‎articles/media-services/latest/security-private-link-connect-private-endpoint-concept.md

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
---
2+
title: Private Endpoint connections overview
3+
description: This article is an overview of Private Endpoint connections with Media Services.
4+
services: media-services
5+
author: IngridAtMicrosoft
6+
manager: femila
7+
ms.service: media-services
8+
ms.topic: conceptual
9+
ms.date: 10/22/2021
10+
ms.author: inhenkel
11+
---
12+
13+
# Private Endpoint connections overview
14+
15+
[!INCLUDE [media services api v3 logo](./includes/v3-hr.md)]
16+
17+
This article is an overview of Private Endpoint connections with Media Services.
18+
19+
## Clients using VNet
20+
21+
Clients on a VNet using the private endpoint should use the same DNS name to connect to Media Services as clients connecting to the public Media Services endpoints. Media Services relies upon DNS resolution to automatically route the connections from the VNet to the Media Services endpoints over a private link.
22+
23+
> [!IMPORTANT]
24+
> Use the same DNS names to the Media Services endpoints when using private endpoints as you’d otherwise use. Please don't connect to the Media Services endpoints using its privatelink subdomain URL.
25+
26+
Media Services creates a [private DNS zone](/dns/private-dns-overview) attached to the VNet with the necessary updates for the private endpoints, by default. However, if you're using your own DNS server, you may need to make additional changes to your DNS configuration. The section on DNS changes below describes the updates required for private endpoints.
27+
28+
## DNS changes for private endpoints
29+
30+
When you create a private endpoint, the **DNS CNAME** resource record for each of the Media Services endpoints is updated to an alias in a subdomain with the prefix `privatelink`. By default, we also create a private DNS zone, corresponding to the `privatelink` subdomain, with the DNS A resource records for the private endpoints.
31+
32+
When you resolve a Media Services DNS name from outside the VNet with the private endpoint, it resolves to the public endpoint of the Media Services endpoint. When resolved from the VNet hosting the private endpoint, the Media Services URL resolves to the private endpoint's IP address.
33+
34+
For example, the DNS resource records for a Streaming Endpoint in the Media Services `MediaAccountA`, when resolved from outside the VNet hosting the private endpoint, will be:
35+
36+
| Name | Type | Value |
37+
| ---- | ---- | ----- |
38+
| mediaaccounta-uswe1.streaming.media.azure.net | CNAME | mediaaccounta-uswe1.streaming.privatelink.media.azure.net |
39+
|mediaaccounta-uswe1.streaming.privatelink.media.azure.net | CNAME | `<Streaming Endpoint public endpoint>` |
40+
| `<Streaming Endpoint public endpoint>` | CNAME | `<Streaming Endpoint internal endpoint>` |
41+
| `<Streaming Endpoint internal endpoint>` | A | `<Streaming Endpoint public IP address>` |
42+
43+
You can deny or restrict public internet access to Media Services endpoints using IP allowlists, or by disabling public network access for all resources within the account.
44+
45+
The DNS resource records for the example Streaming Endpoint in 'MediaAccountA', when resolved by a client in the VNet hosting the private endpoint, will be:
46+
47+
| Name | Type | Value |
48+
| ---- | ---- | ----- |
49+
| mediaaccounta-uswe1.streaming.media.azure.net | CNAME | mediaaccounta-uswe1.streaming.privatelink.media.azure.net |
50+
|mediaaccounta-uswe1.streaming.privatelink.media.azure.net | A | `<Streaming Endpoint public endpoint>`, for example" 10.0.0.9 |
51+
52+
This approach enables access to the Media Services endpoint using the same DNS name for clients within the VNet hosting the private endpoints. It does the same thing for clients outside the VNet.
53+
54+
If you're using a custom DNS server on your network, clients must resolve the FQDN for the Media Services endpoint to the private endpoint IP address. Configure your DNS server to delegate your private link subdomain to the private DNS zone for the VNet, or configure the A records for `mediaaccounta-usw22.streaming.privatelink.media.azure.net` with the private endpoint IP address.
55+
56+
> [!TIP]
57+
> When using a custom or on-premises DNS server, you should configure your DNS server to resolve the Media Services endpoint name in the privatelink subdomain to the private endpoint IP address. You can do this by delegating the privatelink subdomain to the private DNS zone of the VNet, or configuring the DNS zone on your DNS server and adding the DNS A records.
58+
59+
The recommended DNS zone names for private endpoints for storage services, and the associated endpoint target subresources, are:
60+
61+
| Media Services Endpoint | Private Link Group ID | DNS Zone Name |
62+
| ----------------------- | --------------------- | ------------- |
63+
| Streaming Endpoint | streamingendpoint | privatelink.media.azure.net |
64+
| Key Delivery | streamingendpoint | privatelink.media.azure.net |
65+
| Live Event | liveevent | privatelink.media.azure.net |
66+
67+
For more information about configuring your own DNS server to support private endpoints, refer to the following articles:
68+
69+
- [Name resolution for resources in Azure virtual networks](/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances#name-resolution-that-uses-your-own-dns-server)
70+
- [DNS configuration for private endpoints](/private-link/private-endpoint-overview#dns-configuration)
71+
72+
## Public network access flag
73+
74+
The `publicNetworkAccess` flag on the Media Services account can be used to allow or block access to Media Services endpoints from the public internet. When `publicNetworkAccess` is disabled, requests to any Media Services endpoint from the public internet are blocked; requests to private endpoints are still allowed.
75+
76+
## Service level IP allowlists
77+
78+
When `publicNetworkAccess` is enabled, requests from the public internet are allowed, subject to service level IP allowlists. If `publicNetworkAccess` is disabled, requests from the public internet are blocked, regardless of the IP allowlist settings. IP allowlists only apply to requests from the public internet; requests to private endpoints are not filtered by the IP allowlists.

0 commit comments

Comments
 (0)