Package software.amazon.awscdk.services.mediaconnect.alpha

Interface TransitEncryption

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

TransitEncryption.Jsii$Proxy

@Generated(value="jsii-pacmak/1.138.0 (build 0ca7ee8)",
           date="2026-07-31T10:49:55.236Z")
@Stability(Experimental)
public interface TransitEncryption
extends software.amazon.jsii.JsiiSerializable

(experimental) Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.

Uses AWS Secrets Manager for key management.

The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Example:

 Stack stack;
 Flow flow;
 IRole role;
 ISecret secret;
 RouterOutput existingRouterOutput;
 // Flow output to router with transit encryption
 FlowOutput routerOutput = FlowOutput.Builder.create(stack, "RouterOutput")
         .flow(flow)
         .output(OutputConfiguration.router(RouterTransitConfig.builder()
                 .encryption(TransitEncryption.builder().role(role).secret(secret).build())
                 .build()))
         .build();
 // Flow source from router with transit encryption
 Flow flowFromRouter = Flow.Builder.create(stack, "FlowFromRouter")
         .source(SourceConfiguration.router(RouterSource.builder()
                 .routerOutput(existingRouterOutput)
                 .decryption(TransitEncryption.builder().role(role).secret(secret).build())
                 .build()))
         .build();
 

See Also:

• https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static final class	TransitEncryption.Builder	A builder for TransitEncryption
static final class	TransitEncryption.Jsii$Proxy	An implementation for TransitEncryption

Method Summary

Modifier and Type	Method	Description
static TransitEncryption.Builder	builder()
default IRole	getRole()	(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.
ISecret	getSecret()	(experimental) Secrets Manager secret containing the transit encryption key.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Details

getSecret

@Stability(Experimental)
@NotNull
ISecret getSecret()

(experimental) Secrets Manager secret containing the transit encryption key.

getRole

@Stability(Experimental)
@Nullable
default IRole getRole()

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

builder

@Stability(Experimental)
static TransitEncryption.Builder builder()

Returns:

a TransitEncryption.Builder of TransitEncryption