Class RouterSrtEncryption

(experimental) SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Inheritance

object

RouterSrtEncryption

Implements

IRouterSrtEncryption

Inherited Members

object.GetType()

object.MemberwiseClone()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Namespace: Amazon.CDK.AWS.MediaConnect.Alpha

Assembly: Amazon.CDK.AWS.MediaConnect.Alpha.dll

Syntax (csharp)

public class RouterSrtEncryption : IRouterSrtEncryption

Syntax (vb)

Public Class RouterSrtEncryption Implements IRouterSrtEncryption

Remarks

Uses AWS Secrets Manager for key management. Distinct from {@link SrtPasswordEncryption}, which is used for flow sources and outputs.

The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput: / arn:...:routerOutput:) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Stability: Experimental

See: https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

ExampleMetadata: infused

Examples

Stack stack;
             RouterNetworkInterface networkInterface;
             IRole role;
             ISecret secret;


             var output = new RouterOutput(stack, "EncryptedOutput", new RouterOutputProps {
                 RouterOutputName = "encrypted-output",
                 MaximumBitrate = Bitrate.Mbps(10),
                 RoutingScope = RoutingScope.REGIONAL,
                 Tier = RouterOutputTier.OUTPUT_50,
                 Configuration = RouterOutputConfiguration.Standard(new StandardOutputConfigurationProps {
                     Protocol = RouterOutputProtocol.SrtCaller(new SrtCallerOutputProtocolProps {
                         DestinationAddress = "203.0.113.100",
                         DestinationPort = 9001,
                         MinimumLatency = Duration.Millis(200),
                         EncryptionConfiguration = new RouterSrtEncryption { Role = role, Secret = secret }
                     }),
                     NetworkInterface = networkInterface
                 })
             });

Synopsis

Constructors

RouterSrtEncryption()

(experimental) SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Properties

Role	(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.
Secret	(experimental) Secrets Manager secret containing the SRT passphrase.

Constructors

RouterSrtEncryption()

(experimental) SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

public RouterSrtEncryption()

Remarks

Uses AWS Secrets Manager for key management. Distinct from {@link SrtPasswordEncryption}, which is used for flow sources and outputs.

The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput: / arn:...:routerOutput:) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Stability: Experimental

See: https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

ExampleMetadata: infused

Examples

Stack stack;
             RouterNetworkInterface networkInterface;
             IRole role;
             ISecret secret;


             var output = new RouterOutput(stack, "EncryptedOutput", new RouterOutputProps {
                 RouterOutputName = "encrypted-output",
                 MaximumBitrate = Bitrate.Mbps(10),
                 RoutingScope = RoutingScope.REGIONAL,
                 Tier = RouterOutputTier.OUTPUT_50,
                 Configuration = RouterOutputConfiguration.Standard(new StandardOutputConfigurationProps {
                     Protocol = RouterOutputProtocol.SrtCaller(new SrtCallerOutputProtocolProps {
                         DestinationAddress = "203.0.113.100",
                         DestinationPort = 9001,
                         MinimumLatency = Duration.Millis(200),
                         EncryptionConfiguration = new RouterSrtEncryption { Role = role, Secret = secret }
                     }),
                     NetworkInterface = networkInterface
                 })
             });

Properties

Role

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

public IRole? Role { get; set; }

Property Value

IRole

Remarks

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

Stability: Experimental

Secret

(experimental) Secrets Manager secret containing the SRT passphrase.

public ISecret Secret { get; set; }

Property Value

ISecret

Remarks

Stability: Experimental

Implements

IRouterSrtEncryption