Media Services Network Security Manager

Problem Statement

You are tasked with building a network security manager for Azure Media Services that helps administrators configure private connectivity and control public network access. The system should allow listing available private link resources, managing private endpoint connections, and reporting on the security configuration of Media Services accounts.

Requirements

Build a Python application that provides the following functionality:

1. Private Link Resource Discovery: List all private link resources available for a given Media Services account, displaying the resource ID, name, type, and group ID for each resource.

2. Private Endpoint Connection Management:

   • List all private endpoint connections for a Media Services account
   • Retrieve detailed information about a specific private endpoint connection by name
   • Display the connection state (status and description) for each connection

3. Security Configuration Report: Generate a report that shows:

   • The public network access setting for a Media Services account (Enabled or Disabled)
   • The total number of private endpoint connections
   • The number of approved, pending, and rejected private endpoint connections
   • A list of all private link resource groups available

The application should accept command-line arguments to specify the subscription ID, resource group name, and account name, and should support different operation modes (e.g., "list-resources", "list-connections", "get-connection", "report").

Implementation Details

• Create a main module security_manager.py that implements the core functionality
• Use appropriate authentication methods to connect to Azure
• Handle errors gracefully and provide informative error messages
• Format output in a readable manner (you may use simple text formatting or JSON)

Testing

Create a test file test_security_manager.py that includes the following test cases:

Test Case 1: List Private Link Resources @test

Input:

• Subscription ID: "sub-123"
• Resource Group: "media-rg"
• Account Name: "testmediaaccount"
• Operation: "list-resources"

Expected Behavior: The function should call the appropriate API to list private link resources and return a list containing the resource information (ID, name, type, group ID).

Mock Setup: Mock the client to return 2 private link resources:

• Resource 1: name="resource1", group_id="keydelivery"
• Resource 2: name="resource2", group_id="streamingendpoint"

Test Case 2: List Private Endpoint Connections @test

Input:

• Subscription ID: "sub-456"
• Resource Group: "media-rg"
• Account Name: "securemedia"
• Operation: "list-connections"

Expected Behavior: The function should call the appropriate API to list private endpoint connections and return information about each connection including name and connection state.

Mock Setup: Mock the client to return 3 private endpoint connections:

• Connection 1: name="pe-conn-1", state="Approved"
• Connection 2: name="pe-conn-2", state="Pending"
• Connection 3: name="pe-conn-3", state="Rejected"

Test Case 3: Generate Security Report @test

Input:

• Subscription ID: "sub-789"
• Resource Group: "prod-rg"
• Account Name: "prodmedia"
• Operation: "report"

Expected Behavior: The function should generate a comprehensive security report showing public network access status and private connectivity statistics.

Mock Setup: Mock the media services account with:

• Public network access: "Disabled"
• 5 private endpoint connections (3 Approved, 1 Pending, 1 Rejected)
• 2 private link resource groups available

Dependencies { .dependencies }

azure-mgmt-media { .dependency }

Provides management capabilities for Azure Media Services including private endpoint connections and private link resources.

azure-identity { .dependency }

Provides Azure Active Directory authentication support for accessing Azure services.

Notes

• Focus on implementing the private connectivity features correctly
• Ensure proper error handling for cases where resources don't exist
• The test cases should use mocking to avoid requiring actual Azure credentials