Skip to content

Commit ba8772c

Browse files
IngridAtMicrosoftIngridAtMicrosoft
committed
Private Link Starting Over Again
1 parent eb93ca8 commit ba8772c

File tree

4 files changed

+587
-0
lines changed

4 files changed

+587
-0
lines changed

‎articles/media-services/latest/security-private-link-arm-how-to.md

Lines changed: 352 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,352 @@
1+
---
2+
title: Create a Media Services and Storage account with a private link
3+
titleSuffix: Media Services
4+
description: Create a Media Services account and Storage Account with Private Links to a VNet. The Azure Resource Manager (ARM) template also sets up DNS for both the Private Links. Finally the template creates a VM to allow the user to try out the Private Links.
5+
services: media-services
6+
author: IngridAtMicrosoft
7+
manager: femila
8+
ms.service: media-services
9+
ms.topic: how-to
10+
ms.date: 04/15/2021
11+
ms.author: inhenkel
12+
---
13+
14+
# Create a Media Services and Storage account with a Private Link
15+
16+
[!INCLUDE [media services api v3 logo](./includes/v3-hr.md)]
17+
18+
Create a Media Services account and Storage Account with Private Links to a VNet. The Azure Resource Manager (ARM) template also sets up DNS for both the Private Links. Finally the template creates a VM to allow the user to try out the Private Links.
19+
20+
## Prerequisites
21+
22+
Read [Quickstart: Create and deploy ARM templates by using the Azure portal](../../azure-resource-manager/templates/quickstart-create-templates-use-the-portal.md).
23+
24+
## Limitations
25+
26+
- For Media Services, the template only sets up Private Link for Key Delivery.
27+
- A network security group isn't created for the VM.
28+
- Network access control isn't configured for the Storage Account or Key Delivery.
29+
30+
The template creates:
31+
32+
- A Media Services account and a Storage Account (as normal)
33+
- A VNet with a subnet
34+
- For both the Media Services account and the Storage Account:
35+
- Private Endpoints
36+
- Private DNS Zones
37+
- Links between links (to connect the private DNS zones to the VNet)
38+
- Private DNS zone groups (to trigger the automatic creation of DNS records in the private DNS zones)
39+
- A VM (with associated public IP address and network interface)
40+
41+
[!INCLUDE [Azure Policy Media Services](includes/security-azure-policy-private-links.md)]
42+
43+
## Azure Resource Manager (ARM) template for private link
44+
45+
```json
46+
{
47+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
48+
"contentVersion": "1.0.0.0",
49+
"parameters": {
50+
"vmName": {
51+
"type": "string"
52+
},
53+
"vmAdminUsername": {
54+
"type": "string"
55+
},
56+
"vmAdminPassword": {
57+
"type": "secureString"
58+
},
59+
"vmSize": {
60+
"type": "string",
61+
"defaultValue": "Standard_D2_v3"
62+
},
63+
"location": {
64+
"type": "string",
65+
"defaultValue": "[resourceGroup().location]"
66+
},
67+
"storageAccountName": {
68+
"type": "string"
69+
},
70+
"mediaServicesAccountName": {
71+
"type": "string"
72+
}
73+
},
74+
"functions": [],
75+
"resources": [
76+
{
77+
"type": "Microsoft.Storage/storageAccounts",
78+
"apiVersion": "2021-01-01",
79+
"name": "[parameters('storageAccountName')]",
80+
"location": "[parameters('location')]",
81+
"sku": {
82+
"name": "Standard_LRS"
83+
},
84+
"kind": "StorageV2"
85+
},
86+
{
87+
"type": "Microsoft.Media/mediaservices",
88+
"apiVersion": "2020-05-01",
89+
"name": "[parameters('mediaServicesAccountName')]",
90+
"location": "[parameters('location')]",
91+
"properties": {
92+
"storageAccounts": [
93+
{
94+
"type": "Primary",
95+
"id": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
96+
}
97+
]
98+
},
99+
"identity": {
100+
"type": "SystemAssigned"
101+
},
102+
"dependsOn": [
103+
"[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
104+
]
105+
},
106+
{
107+
"type": "Microsoft.Network/virtualNetworks",
108+
"apiVersion": "2020-08-01",
109+
"name": "myVnet",
110+
"location": "[parameters('location')]",
111+
"properties": {
112+
"addressSpace": {
113+
"addressPrefixes": [
114+
"10.0.0.0/16"
115+
]
116+
},
117+
"subnets": [
118+
{
119+
"name": "mySubnet",
120+
"properties": {
121+
"addressPrefix": "10.0.0.0/24",
122+
"privateEndpointNetworkPolicies": "Disabled"
123+
}
124+
}
125+
]
126+
}
127+
},
128+
{
129+
"type": "Microsoft.Network/privateEndpoints",
130+
"apiVersion": "2020-08-01",
131+
"name": "storagePrivateEndpoint",
132+
"location": "[parameters('location')]",
133+
"properties": {
134+
"subnet": {
135+
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', 'myVnet')).subnets[0].id]"
136+
},
137+
"privateLinkServiceConnections": [
138+
{
139+
"name": "storagePrivateEndpointConnection",
140+
"properties": {
141+
"privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
142+
"groupIds": [
143+
"blob"
144+
]
145+
}
146+
}
147+
]
148+
},
149+
"dependsOn": [
150+
"[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
151+
"[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
152+
]
153+
},
154+
{
155+
"type": "Microsoft.Network/privateDnsZones",
156+
"apiVersion": "2020-06-01",
157+
"name": "privatelink.blob.core.windows.net",
158+
"location": "global"
159+
},
160+
{
161+
"type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
162+
"apiVersion": "2020-06-01",
163+
"name": "[format('{0}/storageDnsZoneLink', 'privatelink.blob.core.windows.net')]",
164+
"location": "global",
165+
"properties": {
166+
"registrationEnabled": false,
167+
"virtualNetwork": {
168+
"id": "[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
169+
}
170+
},
171+
"dependsOn": [
172+
"[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.blob.core.windows.net')]",
173+
"[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
174+
]
175+
},
176+
{
177+
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
178+
"apiVersion": "2020-08-01",
179+
"name": "[format('{0}/storagePrivateDnsZoneGroup', 'storagePrivateEndpoint')]",
180+
"properties": {
181+
"privateDnsZoneConfigs": [
182+
{
183+
"name": "config1",
184+
"properties": {
185+
"privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.blob.core.windows.net')]"
186+
}
187+
}
188+
]
189+
},
190+
"dependsOn": [
191+
"[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.blob.core.windows.net')]",
192+
"[resourceId('Microsoft.Network/privateEndpoints', 'storagePrivateEndpoint')]"
193+
]
194+
},
195+
{
196+
"type": "Microsoft.Network/privateEndpoints",
197+
"apiVersion": "2020-08-01",
198+
"name": "mediaServicesPrivateEndpoint",
199+
"location": "[parameters('location')]",
200+
"properties": {
201+
"subnet": {
202+
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', 'myVnet')).subnets[0].id]"
203+
},
204+
"privateLinkServiceConnections": [
205+
{
206+
"name": "mediaServicesPrivateEndpointConnection",
207+
"properties": {
208+
"privateLinkServiceId": "[resourceId('Microsoft.Media/mediaservices', parameters('mediaServicesAccountName'))]",
209+
"groupIds": [
210+
"keydelivery"
211+
]
212+
}
213+
}
214+
]
215+
},
216+
"dependsOn": [
217+
"[resourceId('Microsoft.Media/mediaservices', parameters('mediaServicesAccountName'))]",
218+
"[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
219+
]
220+
},
221+
{
222+
"type": "Microsoft.Network/privateDnsZones",
223+
"apiVersion": "2020-06-01",
224+
"name": "privatelink.media.azure.net",
225+
"location": "global"
226+
},
227+
{
228+
"type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
229+
"apiVersion": "2020-06-01",
230+
"name": "[format('{0}/mediaServicesDnsZoneLink', 'privatelink.media.azure.net')]",
231+
"location": "global",
232+
"properties": {
233+
"registrationEnabled": false,
234+
"virtualNetwork": {
235+
"id": "[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
236+
}
237+
},
238+
"dependsOn": [
239+
"[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.media.azure.net')]",
240+
"[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
241+
]
242+
},
243+
{
244+
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
245+
"apiVersion": "2020-08-01",
246+
"name": "[format('{0}/mediaServicesPrivateDnsZoneGroup', 'mediaServicesPrivateEndpoint')]",
247+
"properties": {
248+
"privateDnsZoneConfigs": [
249+
{
250+
"name": "config1",
251+
"properties": {
252+
"privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.media.azure.net')]"
253+
}
254+
}
255+
]
256+
},
257+
"dependsOn": [
258+
"[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.media.azure.net')]",
259+
"[resourceId('Microsoft.Network/privateEndpoints', 'mediaServicesPrivateEndpoint')]"
260+
]
261+
},
262+
{
263+
"type": "Microsoft.Network/publicIPAddresses",
264+
"apiVersion": "2020-08-01",
265+
"name": "publicIp",
266+
"location": "[parameters('location')]",
267+
"properties": {
268+
"publicIPAllocationMethod": "Dynamic",
269+
"dnsSettings": {
270+
"domainNameLabel": "[toLower(parameters('vmName'))]"
271+
}
272+
}
273+
},
274+
{
275+
"type": "Microsoft.Network/networkInterfaces",
276+
"apiVersion": "2020-08-01",
277+
"name": "vmNetworkInterface",
278+
"location": "[parameters('location')]",
279+
"properties": {
280+
"ipConfigurations": [
281+
{
282+
"name": "ipConfig1",
283+
"properties": {
284+
"privateIPAllocationMethod": "Dynamic",
285+
"publicIPAddress": {
286+
"id": "[resourceId('Microsoft.Network/publicIPAddresses', 'publicIp')]"
287+
},
288+
"subnet": {
289+
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', 'myVnet')).subnets[0].id]"
290+
}
291+
}
292+
}
293+
]
294+
},
295+
"dependsOn": [
296+
"[resourceId('Microsoft.Network/publicIPAddresses', 'publicIp')]",
297+
"[resourceId('Microsoft.Network/virtualNetworks', 'myVnet')]"
298+
]
299+
},
300+
{
301+
"type": "Microsoft.Compute/virtualMachines",
302+
"apiVersion": "2020-12-01",
303+
"name": "myVM",
304+
"location": "[parameters('location')]",
305+
"properties": {
306+
"hardwareProfile": {
307+
"vmSize": "[parameters('vmSize')]"
308+
},
309+
"osProfile": {
310+
"computerName": "[parameters('vmName')]",
311+
"adminUsername": "[parameters('vmAdminUsername')]",
312+
"adminPassword": "[parameters('vmAdminPassword')]"
313+
},
314+
"storageProfile": {
315+
"imageReference": {
316+
"publisher": "MicrosoftWindowsServer",
317+
"offer": "WindowsServer",
318+
"sku": "2019-Datacenter",
319+
"version": "latest"
320+
},
321+
"osDisk": {
322+
"name": "osDisk",
323+
"caching": "ReadWrite",
324+
"createOption": "FromImage",
325+
"managedDisk": {
326+
"storageAccountType": "Standard_LRS"
327+
},
328+
"diskSizeGB": 128
329+
}
330+
},
331+
"networkProfile": {
332+
"networkInterfaces": [
333+
{
334+
"id": "[resourceId('Microsoft.Network/networkInterfaces', 'vmNetworkInterface')]"
335+
}
336+
]
337+
}
338+
},
339+
"dependsOn": [
340+
"[resourceId('Microsoft.Network/networkInterfaces', 'vmNetworkInterface')]"
341+
]
342+
}
343+
],
344+
"metadata": {
345+
"_generator": {
346+
"name": "bicep",
347+
"version": "0.3.126.58533",
348+
"templateHash": "2006367938138350540"
349+
}
350+
}
351+
}
352+
```

0 commit comments

Comments
 (0)