interface TransitEncryption
| Language | Type name |
|---|---|
 .NET | Amazon.CDK.AWS.MediaConnect.Alpha.TransitEncryption |
 Go | github.com/aws/aws-cdk-go/awsmediaconnectalpha/v2#TransitEncryption |
 Java | software.amazon.awscdk.services.mediaconnect.alpha.TransitEncryption |
 Python | aws_cdk.aws_mediaconnect_alpha.TransitEncryption |
 TypeScript (source) | @aws-cdk/aws-mediaconnect-alpha » TransitEncryption |
Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.
Uses AWS Secrets Manager for key management.
The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.
Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth
time), and pinning the live ARN would create a CloudFormation dependency cycle — so the
auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* /
arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply
your own role.
Example
declare const stack: Stack;
declare const mediaLiveChannel: medialive.IChannel;
declare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
const input = new RouterInput(stack, 'ChannelInput', {
routerInputName: 'channel-input',
maximumBitrate: Bitrate.mbps(20),
routingScope: RoutingScope.REGIONAL,
tier: RouterInputTier.INPUT_50,
configuration: RouterInputConfiguration.mediaLiveChannel({
channel: mediaLiveChannel,
outputName: 'router-ts',
pipeline: MediaLivePipeline.PIPELINE_0,
sourceTransitDecryption: { secret: transitSecret },
}),
});
Properties
| Name | Type | Description |
|---|---|---|
| secret | ISecret | Secrets Manager secret containing the transit encryption key. |
| role? | IRole | IAM role that MediaConnect assumes to access the Secrets Manager secret. |
secret
Type:
ISecret
Secrets Manager secret containing the transit encryption key.
role?
Type:
IRole
(optional, default: a scoped role is auto-created with read access to the secret and a
confused-deputy trust condition. See the Encryption section of the module README
for the generated trust policy.)
IAM role that MediaConnect assumes to access the Secrets Manager secret.
If provided, the role is used as-is; you must grant it the necessary permissions yourself.