> **Experimental**
>
> `@aws-cdk/aws-mediaconnect-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# StaticKeyEncryption

Static key encryption/decryption configuration for Zixi protocol sources and outputs, and flow entitlements.

The secret must live in the same AWS account and Region as the resource (source,
output, or entitlement) that uses it. MediaConnect does not support cross-account or
cross-Region secrets.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/shared.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-mediaconnect-alpha/lib/shared.ts#L509)

## Example

```ts
declare const stack: Stack;
declare const flow: Flow;
declare const role: iam.IRole;
declare const secret: secretsmanager.ISecret;

const entitlement = new FlowEntitlement(stack, 'MyEntitlement', {
  flow: flow,
  description: 'Grant partner access to live feed',
  subscribers: ['111122223333'],
  encryption: {
    role,
    secret,
    algorithm: EncryptionAlgorithm.AES256,
  },
});
```

## Properties

- `algorithm`: [EncryptionAlgorithm](/cdk/api/v2/docs/@aws-cdk_aws-mediaconnect-alpha.EncryptionAlgorithm.html) (required) — The encryption algorithm to use.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — IAM role that MediaConnect assumes to access the Secrets Manager secret.

  **Default:** a scoped role is auto-created with read access to the secret (including `kms:Decrypt` for a customer-managed key) and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

  If provided, the role is used as-is; you must grant it the necessary permissions
  yourself.

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) (required) — Secrets Manager secret containing the static encryption key.