> **Experimental**
>
> `@aws-cdk/aws-mediaconnect-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# RouterSrtEncryption

SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).

Uses AWS Secrets Manager for key management. Distinct from
{@link SrtPasswordEncryption}, which is used for flow sources and outputs.

The secret must live in the same AWS account and Region as the router I/O that uses
it. MediaConnect does not support cross-account or cross-Region secrets.

**Trust-policy scope on routers.** Router I/O ids are service-generated (unknown at synth
time), and pinning the live ARN would create a CloudFormation dependency cycle — so the
auto-created role pins `aws:SourceArn` to a wildcarded ARN (`arn:...:routerInput:*` /
`arn:...:routerOutput:*`) plus `aws:SourceAccount`. To pin a tighter trust policy, supply
your own `role`.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/shared.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-mediaconnect-alpha/lib/shared.ts#L610)

## Example

```ts
declare const stack: Stack;
declare const networkInterface: RouterNetworkInterface;
declare const role: iam.IRole;
declare const secret: secretsmanager.ISecret;

const output = new RouterOutput(stack, 'EncryptedOutput', {
  routerOutputName: 'encrypted-output',
  maximumBitrate: Bitrate.mbps(10),
  routingScope: RoutingScope.REGIONAL,
  tier: RouterOutputTier.OUTPUT_20,
  configuration: RouterOutputConfiguration.standard({
    protocol: RouterOutputProtocol.srtCaller({
      destinationAddress: '203.0.113.100',
      destinationPort: 9001,
      minimumLatency: Duration.millis(200),
      encryptionConfiguration: { role, secret },
    }),
    networkInterface: networkInterface,
  }),
});
```

## Properties

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — IAM role that MediaConnect assumes to access the Secrets Manager secret.

  **Default:** a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

  If provided, the role is used as-is; you must grant it the necessary permissions
  yourself.

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) (required) — Secrets Manager secret containing the SRT passphrase.