RouterSrtEncryption

class aws_cdk.aws_mediaconnect_alpha.RouterSrtEncryption(*, secret, role=None)

Bases: object

(experimental) SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Uses AWS Secrets Manager for key management. Distinct from {@link SrtPasswordEncryption}, which is used for flow sources and outputs.

The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Parameters:

  • secret (ISecret) – (experimental) Secrets Manager secret containing the SRT passphrase.

  • role (Optional[IRole]) – (experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret. If provided, the role is used as-is; you must grant it the necessary permissions yourself. Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

See:

https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Stability:

experimental

ExampleMetadata:

infused

Example:

from aws_cdk.aws_mediaconnect_alpha import RouterSrtEncryption
# stack: Stack
# network_interface: RouterNetworkInterface
# role: iam.IRole
# secret: secretsmanager.ISecret


output = RouterOutput(stack, "EncryptedOutput",
    router_output_name="encrypted-output",
    maximum_bitrate=Bitrate.mbps(10),
    routing_scope=RoutingScope.REGIONAL,
    tier=RouterOutputTier.OUTPUT_50,
    configuration=RouterOutputConfiguration.standard(
        protocol=RouterOutputProtocol.srt_caller(
            destination_address="203.0.113.100",
            destination_port=9001,
            minimum_latency=Duration.millis(200),
            encryption_configuration=RouterSrtEncryption(role=role, secret=secret)
        ),
        network_interface=network_interface
    )
)

Attributes

role

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default:

  • a scoped role is auto-created with read access to the secret and a

confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

Stability:

experimental

secret

(experimental) Secrets Manager secret containing the SRT passphrase.

Stability:

experimental