2.263.0

interface TransitEncryption 🔹

LanguageType name
.NETAmazon.CDK.AWS.MediaConnect.Alpha.TransitEncryption
Gogithub.com/aws/aws-cdk-go/awsmediaconnectalpha/v2#TransitEncryption
Javasoftware.amazon.awscdk.services.mediaconnect.alpha.TransitEncryption
Pythonaws_cdk.aws_mediaconnect_alpha.TransitEncryption
TypeScript (source)@aws-cdk/aws-mediaconnect-alpha » TransitEncryption

Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.

Uses AWS Secrets Manager for key management.

The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

See also: https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Example

declare const stack: Stack;
declare const flow: Flow;
declare const role: iam.IRole;
declare const secret: secretsmanager.ISecret;
declare const existingRouterOutput: RouterOutput;

// Flow output to router with transit encryption
const routerOutput = new FlowOutput(stack, 'RouterOutput', {
  flow: flow,
  output: OutputConfiguration.router({
    encryption: { role, secret },
  }),
});

// Flow source from router with transit encryption
const flowFromRouter = new Flow(stack, 'FlowFromRouter', {
  source: SourceConfiguration.router({
    routerOutput: existingRouterOutput,
    decryption: { role, secret },
  }),
});

Properties

NameTypeDescription
secret🔹ISecretSecrets Manager secret containing the transit encryption key.
role?🔹IRoleIAM role that MediaConnect assumes to access the Secrets Manager secret.

secret🔹

Type: ISecret

Secrets Manager secret containing the transit encryption key.

role?🔹

Type: IRole (optional, default: a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.)

IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

← PreviousNext →