Experimental
@aws-cdk/aws-mediaconnect-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.
RouterSrtEncryption Struct
SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).
Uses AWS Secrets Manager for key management. Distinct from {@link SrtPasswordEncryption}, which is used for flow sources and outputs.
The secret must live in the same AWS account and Region as the router I/O that uses it. MediaConnect does not support cross-account or cross-Region secrets.
Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.
Example
declare const stack: Stack;
declare const networkInterface: RouterNetworkInterface;
declare const role: iam.IRole;
declare const secret: secretsmanager.ISecret;
const output = new RouterOutput(stack, 'EncryptedOutput', {
routerOutputName: 'encrypted-output',
maximumBitrate: Bitrate.mbps(10),
routingScope: RoutingScope.REGIONAL,
tier: RouterOutputTier.OUTPUT_20,
configuration: RouterOutputConfiguration.standard({
protocol: RouterOutputProtocol.srtCaller({
destinationAddress: '203.0.113.100',
destinationPort: 9001,
minimumLatency: Duration.millis(200),
encryptionConfiguration: { role, secret },
}),
networkInterface: networkInterface,
}),
});
Properties
Default: a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.
If provided, the role is used as-is; you must grant it the necessary permissions yourself.