Experimental
@aws-cdk/aws-mediaconnect-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.
TransitEncryption Struct
Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.
Uses AWS Secrets Manager for key management.
The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.
Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.
Example
declare const stack: Stack;
declare const mediaLiveChannel: medialive.IChannel;
declare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret
const input = new RouterInput(stack, 'ChannelInput', {
routerInputName: 'channel-input',
maximumBitrate: Bitrate.mbps(20),
routingScope: RoutingScope.REGIONAL,
tier: RouterInputTier.INPUT_20,
configuration: RouterInputConfiguration.mediaLiveChannel({
channel: mediaLiveChannel,
outputName: 'router-ts',
pipeline: MediaLivePipeline.PIPELINE_0,
sourceTransitDecryption: { secret: transitSecret },
}),
});
Properties
Default: a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.
If provided, the role is used as-is; you must grant it the necessary permissions yourself.