> **Experimental**
>
> `@aws-cdk/aws-medialive-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# MediaConnectRouterPipelineConfig

Per-pipeline settings for a MediaConnect Router output destination.

Today this carries only transit encryption, but it is a struct so that future per-pipeline
MediaConnect Router settings can be added without an API break.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/destinations.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-medialive-alpha/lib/destinations.ts#L385)

## Example

```ts
declare const video: medialive.EncodeConfiguration;
declare const audio: medialive.EncodeConfiguration;
declare const passphrase: secretsmanager.ISecret;
declare const passphrase1: secretsmanager.ISecret;

// AUTOMATIC encryption on every pipeline (MPEG-TS container, like UDP)
medialive.OutputGroupConfiguration.mediaConnectRouter({
  name: 'router_out',
  availabilityZones: ['us-east-1a'],
  outputs: [{ encodes: [video, audio], outputName: 'router_ts' }],
});

// One shared Secrets Manager passphrase across all pipelines (SECRETS_MANAGER encryption)
medialive.OutputGroupConfiguration.mediaConnectRouter({
  name: 'router_out',
  availabilityZones: ['us-east-1a'],
  routerSettings: medialive.MediaConnectRouterSettings.shared({ encryptionSecret: passphrase }),
  outputs: [{ encodes: [video, audio], outputName: 'router_ts' }],
});

// Distinct encryption per pipeline — an omitted pipeline stays AUTOMATIC (STANDARD channels)
medialive.OutputGroupConfiguration.mediaConnectRouter({
  name: 'router_out',
  availabilityZones: ['us-east-1a', 'us-east-1b'],
  routerSettings: medialive.MediaConnectRouterSettings.perPipeline({
    pipeline1: { encryptionSecret: passphrase1 },
  }),
  outputs: [{ encodes: [video, audio], outputName: 'router_ts' }],
});
```

## Properties

- `encryptionSecret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) — A Secrets Manager secret holding the transit-encryption passphrase.

  **Default:** AUTOMATIC (service-managed) transit encryption

  When set, the pipeline
  uses `SECRETS_MANAGER` encryption; the channel role is granted read access to the secret.