TransitEncryption

class aws_cdk.aws_mediaconnect_alpha.TransitEncryption(*, secret, role=None)

Bases: object

(experimental) Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.

Uses AWS Secrets Manager for key management.

The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Parameters:

  • secret (ISecret) – (experimental) Secrets Manager secret containing the transit encryption key.

  • role (Optional[IRole]) – (experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret. If provided, the role is used as-is; you must grant it the necessary permissions yourself. Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

See:

https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Stability:

experimental

ExampleMetadata:

infused

Example:

from aws_cdk.aws_mediaconnect_alpha import TransitEncryption, TransitEncryption
# stack: Stack
# flow: Flow
# role: iam.IRole
# secret: secretsmanager.ISecret
# existing_router_output: RouterOutput


# Flow output to router with transit encryption
router_output = FlowOutput(stack, "RouterOutput",
    flow=flow,
    output=OutputConfiguration.router(
        encryption=TransitEncryption(role=role, secret=secret)
    )
)

# Flow source from router with transit encryption
flow_from_router = Flow(stack, "FlowFromRouter",
    source=SourceConfiguration.router(
        router_output=existing_router_output,
        decryption=TransitEncryption(role=role, secret=secret)
    )
)

Attributes

role

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default:

  • a scoped role is auto-created with read access to the secret and a

confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

Stability:

experimental

secret

(experimental) Secrets Manager secret containing the transit encryption key.

Stability:

experimental