This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.
AWS::MediaPackageV2::OriginEndpoint SpekeKeyProvider
The parameters for the SPEKE key provider.
Syntax
To declare this entity in your CloudFormation template, use the following syntax:
JSON
{ "CertificateArn" :String, "ContentKeyPeriodConfiguration" :ContentKeyPeriodConfiguration, "DrmSystems" :[ String, ... ], "EncryptionContractConfiguration" :EncryptionContractConfiguration, "ResourceId" :String, "RoleArn" :String, "SpekeVersion" :String, "Url" :String}
YAML
CertificateArn:StringContentKeyPeriodConfiguration:ContentKeyPeriodConfigurationDrmSystems:- StringEncryptionContractConfiguration:EncryptionContractConfigurationResourceId:StringRoleArn:StringSpekeVersion:StringUrl:String
Properties
CertificateArn-
The ARN for the certificate that you imported to AWS Certificate Manager to add content key encryption to this endpoint. For this feature to work, your DRM key provider must support content key encryption.
Required: No
Type: String
Pattern:
^arn:([^:\n]+):acm:([^:\n]+):([0-9]+):certificate/[a-zA-Z0-9-_]+$Minimum:
20Maximum:
2048Update requires: No interruption
ContentKeyPeriodConfiguration-
The configuration that controls whether MediaPackage signals the start and end times a content key is used for, in the
ContentKeyPeriodsent to your DRM key provider. Signaling this timing is supported only when key rotation is enabled (KeyRotationIntervalSecondsis set to a non-zero value) andSpekeVersionisV2_1. You can update these settings on an existing origin endpoint.Required: No
Type: ContentKeyPeriodConfiguration
Update requires: No interruption
DrmSystems-
The DRM solution provider you're using to protect your content during distribution.
Required: Yes
Type: Array of String
Minimum:
1Maximum:
4Update requires: No interruption
EncryptionContractConfiguration-
The encryption contract configuration associated with the SPEKE key provider.
Required: Yes
Type: EncryptionContractConfiguration
Update requires: No interruption
ResourceId-
The unique identifier for the content. The service sends this identifier to the key server to identify the current endpoint. How unique you make this identifier depends on how fine-grained you want access controls to be. The service does not permit you to use the same ID for two simultaneous encryption processes. The resource ID is also known as the content ID.
The following example shows a resource ID:
MovieNight20171126093045Required: Yes
Type: String
Pattern:
^[0-9a-zA-Z_-]+$Minimum:
1Maximum:
256Update requires: No interruption
RoleArn-
The ARN for the IAM role granted by the key provider that provides access to the key provider API. This role must have a trust policy that allows MediaPackage to assume the role, and it must have a sufficient permissions policy to allow access to the specific key retrieval URL. Get this from your DRM solution provider.
Valid format:
arn:aws:iam::{accountID}:role/{name}. The following example shows a role ARN:arn:aws:iam::444455556666:role/SpekeAccessRequired: Yes
Type: String
Minimum:
1Maximum:
2048Update requires: No interruption
SpekeVersion-
Specifies the SPEKE version used with your DRM key provider. If you don't specify a value, the default is
V2_0.The allowed values are:
-
V2_0- Follows the SPEKE Version 2.0 contract and signals only the content key index in key requests. This is the default. -
V2_1- Follows the SPEKE Version 2.1 contract and additionally supports signaling the start and end times a content key is used for, usingContentKeyPeriodConfiguration.
For more information, see SPEKE Version 2.0 payload.
Required: No
Type: String
Allowed values:
V2_0 | V2_1Update requires: No interruption
-
Url-
The URL of the SPEKE key provider.
Required: Yes
Type: String
Minimum:
1Maximum:
1024Update requires: No interruption
