2.263.0

interface RouterSrtEncryption 🔹

LanguageType name
.NETAmazon.CDK.AWS.MediaConnect.Alpha.RouterSrtEncryption
Gogithub.com/aws/aws-cdk-go/awsmediaconnectalpha/v2#RouterSrtEncryption
Javasoftware.amazon.awscdk.services.mediaconnect.alpha.RouterSrtEncryption
Pythonaws_cdk.aws_mediaconnect_alpha.RouterSrtEncryption
TypeScript (source)@aws-cdk/aws-mediaconnect-alpha » RouterSrtEncryption

SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Uses AWS Secrets Manager for key management. Distinct from {@link SrtPasswordEncryption}, which is used for flow sources and outputs.

The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

See also: https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Example

declare const stack: Stack;
declare const networkInterface: RouterNetworkInterface;
declare const role: iam.IRole;
declare const secret: secretsmanager.ISecret;

const output = new RouterOutput(stack, 'EncryptedOutput', {
  routerOutputName: 'encrypted-output',
  maximumBitrate: Bitrate.mbps(10),
  routingScope: RoutingScope.REGIONAL,
  tier: RouterOutputTier.OUTPUT_50,
  configuration: RouterOutputConfiguration.standard({
    protocol: RouterOutputProtocol.srtCaller({
      destinationAddress: '203.0.113.100',
      destinationPort: 9001,
      minimumLatency: Duration.millis(200),
      encryptionConfiguration: { role, secret },
    }),
    networkInterface: networkInterface,
  }),
});

Properties

NameTypeDescription
secret🔹ISecretSecrets Manager secret containing the SRT passphrase.
role?🔹IRoleIAM role that MediaConnect assumes to access the Secrets Manager secret.

secret🔹

Type: ISecret

Secrets Manager secret containing the SRT passphrase.

role?🔹

Type: IRole (optional, default: a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.)

IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

← PreviousNext →