Package software.amazon.awscdk.services.mediaconnect.alpha

Interface StaticKeyEncryption

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

StaticKeyEncryption.Jsii$Proxy

@Generated(value="jsii-pacmak/1.138.0 (build 0ca7ee8)",
           date="2026-07-31T10:49:55.235Z")
@Stability(Experimental)
public interface StaticKeyEncryption
extends software.amazon.jsii.JsiiSerializable

(experimental) Static key encryption/decryption configuration for Zixi protocol sources and outputs, and flow entitlements.

The secret must live in the same AWS account and Region as the resource (source, output, or entitlement) that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Example:

 Stack stack;
 Flow flow;
 IRole role;
 ISecret secret;
 FlowEntitlement entitlement = FlowEntitlement.Builder.create(stack, "MyEntitlement")
         .flow(flow)
         .description("Grant partner access to live feed")
         .subscribers(List.of("111122223333"))
         .encryption(StaticKeyEncryption.builder()
                 .role(role)
                 .secret(secret)
                 .algorithm(EncryptionAlgorithm.AES256)
                 .build())
         .build();
 

See Also:

• https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	StaticKeyEncryption.Builder	A builder for StaticKeyEncryption
static final class	StaticKeyEncryption.Jsii$Proxy	An implementation for StaticKeyEncryption

Method Summary

Modifier and Type	Method	Description
static StaticKeyEncryption.Builder	builder()
EncryptionAlgorithm	getAlgorithm()	(experimental) The encryption algorithm to use.
default IRole	getRole()	(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.
ISecret	getSecret()	(experimental) Secrets Manager secret containing the static encryption key.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getAlgorithm

@Stability(Experimental)
@NotNull
EncryptionAlgorithm getAlgorithm()

(experimental) The encryption algorithm to use.

getSecret

@Stability(Experimental)
@NotNull
ISecret getSecret()

(experimental) Secrets Manager secret containing the static encryption key.

getRole

@Stability(Experimental)
@Nullable
default IRole getRole()

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default: - a scoped role is auto-created with read access to the secret (including `kms:Decrypt` for a customer-managed key) and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

builder

@Stability(Experimental)
static StaticKeyEncryption.Builder builder()

Returns:

a StaticKeyEncryption.Builder of StaticKeyEncryption