Experimental
@aws-cdk/aws-mediaconnect-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.
TransitEncryption Struct
Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.
Uses AWS Secrets Manager for key management.
The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.
Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.
Example
declare const stack: Stack;
declare const mediaLiveChannel: medialive.IChannel;
declare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
const input = new RouterInput(stack, 'ChannelInput', {
routerInputName: 'channel-input',
maximumBitrate: Bitrate.mbps(20),
routingScope: RoutingScope.REGIONAL,
tier: RouterInputTier.INPUT_20,
configuration: RouterInputConfiguration.mediaLiveChannel({
channel: mediaLiveChannel,
outputName: 'router-ts',
pipeline: MediaLivePipeline.PIPELINE_0,
sourceTransitDecryption: { secret: transitSecret },
}),
});
from aws_cdk.aws_mediaconnect_alpha import TransitEncryption
# stack: Stack
# media_live_channel: medialive.IChannel
# transit_secret: Secret
# must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
input = RouterInput(stack, "ChannelInput",
router_input_name="channel-input",
maximum_bitrate=Bitrate.mbps(20),
routing_scope=RoutingScope.REGIONAL,
tier=RouterInputTier.INPUT_20,
configuration=RouterInputConfiguration.media_live_channel(
channel=media_live_channel,
output_name="router-ts",
pipeline=MediaLivePipeline.PIPELINE_0,
source_transit_decryption=TransitEncryption(secret=transit_secret)
)
)
Stack stack;
IChannel mediaLiveChannel;
Secret transitSecret;
// must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
RouterInput input = RouterInput.Builder.create(stack, "ChannelInput")
.routerInputName("channel-input")
.maximumBitrate(Bitrate.mbps(20))
.routingScope(RoutingScope.REGIONAL)
.tier(RouterInputTier.INPUT_20)
.configuration(RouterInputConfiguration.mediaLiveChannel(MediaLiveChannelConfigurationProps.builder()
.channel(mediaLiveChannel)
.outputName("router-ts")
.pipeline(MediaLivePipeline.PIPELINE_0)
.sourceTransitDecryption(TransitEncryption.builder().secret(transitSecret).build())
.build()))
.build();
// Install: dotnet add package Amazon.CDK.AWS.MediaConnect.Alpha
Stack stack;
IChannel mediaLiveChannel;
Secret transitSecret;
// must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
var input = new RouterInput(stack, "ChannelInput", new RouterInputProps {
RouterInputName = "channel-input",
MaximumBitrate = Bitrate.Mbps(20),
RoutingScope = RoutingScope.REGIONAL,
Tier = RouterInputTier.INPUT_20,
Configuration = RouterInputConfiguration.MediaLiveChannel(new MediaLiveChannelConfigurationProps {
Channel = mediaLiveChannel,
OutputName = "router-ts",
Pipeline = MediaLivePipeline.PIPELINE_0,
SourceTransitDecryption = new TransitEncryption { Secret = transitSecret }
})
});
// Install: go get github.com/aws/aws-cdk-go/awsmediaconnectalpha/v2
var stack Stack
var mediaLiveChannel IChannel
var transitSecret Secret
// must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
input := awsmediaconnectalpha.NewRouterInput(stack, jsii.String("ChannelInput"), &RouterInputProps{
RouterInputName: jsii.String("channel-input"),
MaximumBitrate: awscdk.Bitrate_Mbps(jsii.Number(20)),
RoutingScope: awsmediaconnectalpha.RoutingScope_REGIONAL(),
Tier: awsmediaconnectalpha.RouterInputTier_INPUT_20(),
Configuration: awsmediaconnectalpha.RouterInputConfiguration_MediaLiveChannel(&MediaLiveChannelConfigurationProps{
Channel: mediaLiveChannel,
OutputName: jsii.String("router-ts"),
Pipeline: awsmediaconnectalpha.MediaLivePipeline_PIPELINE_0,
SourceTransitDecryption: &TransitEncryption{
Secret: transitSecret,
},
}),
})
Properties
Default: a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.
If provided, the role is used as-is; you must grant it the necessary permissions yourself.