Package software.amazon.awscdk.services.mediaconnect.alpha

Interface RouterSrtEncryption

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

RouterSrtEncryption.Jsii$Proxy

@Generated(value="jsii-pacmak/1.138.0 (build 0ca7ee8)",
           date="2026-07-31T10:49:55.222Z")
@Stability(Experimental)
public interface RouterSrtEncryption
extends software.amazon.jsii.JsiiSerializable

(experimental) SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Uses AWS Secrets Manager for key management. Distinct from SrtPasswordEncryption, which is used for flow sources and outputs. The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets. **Trust-policy scope on routers.** Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins `aws:SourceArn` to a wildcarded ARN (`arn:...:routerInput:*` / `arn:...:routerOutput:*`) plus `aws:SourceAccount`. To pin a tighter trust policy, supply your own `role`.

Example:

 Stack stack;
 RouterNetworkInterface networkInterface;
 IRole role;
 ISecret secret;
 RouterOutput output = RouterOutput.Builder.create(stack, "EncryptedOutput")
         .routerOutputName("encrypted-output")
         .maximumBitrate(Bitrate.mbps(10))
         .routingScope(RoutingScope.REGIONAL)
         .tier(RouterOutputTier.OUTPUT_50)
         .configuration(RouterOutputConfiguration.standard(StandardOutputConfigurationProps.builder()
                 .protocol(RouterOutputProtocol.srtCaller(SrtCallerOutputProtocolProps.builder()
                         .destinationAddress("203.0.113.100")
                         .destinationPort(9001)
                         .minimumLatency(Duration.millis(200))
                         .encryptionConfiguration(RouterSrtEncryption.builder().role(role).secret(secret).build())
                         .build()))
                 .networkInterface(networkInterface)
                 .build()))
         .build();
 

See Also:

• https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	RouterSrtEncryption.Builder	A builder for RouterSrtEncryption
static final class	RouterSrtEncryption.Jsii$Proxy	An implementation for RouterSrtEncryption

Method Summary

Modifier and Type	Method	Description
static RouterSrtEncryption.Builder	builder()
default IRole	getRole()	(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.
ISecret	getSecret()	(experimental) Secrets Manager secret containing the SRT passphrase.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getSecret

@Stability(Experimental)
@NotNull
ISecret getSecret()

(experimental) Secrets Manager secret containing the SRT passphrase.

getRole

@Stability(Experimental)
@Nullable
default IRole getRole()

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

builder

@Stability(Experimental)
static RouterSrtEncryption.Builder builder()

Returns:

a RouterSrtEncryption.Builder of RouterSrtEncryption