> **Experimental**
>
> `@aws-cdk/aws-mediaconnect-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# TransitEncryption

Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.

Uses AWS Secrets Manager for key
management.

The secret must live in the same AWS account and Region as the consuming resource.
MediaConnect does not support cross-account or cross-Region secrets.

**Trust-policy scope on routers.** Router I/O ids are service-generated (unknown at synth
time), and pinning the live ARN would create a CloudFormation dependency cycle — so the
auto-created role pins `aws:SourceArn` to a wildcarded ARN (`arn:...:routerInput:*` /
`arn:...:routerOutput:*`) plus `aws:SourceAccount`. To pin a tighter trust policy, supply
your own `role`.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/shared.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-mediaconnect-alpha/lib/shared.ts#L576)

## Example

```ts
declare const stack: Stack;
declare const mediaLiveChannel: medialive.IChannel;
declare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret

const input = new RouterInput(stack, 'ChannelInput', {
  routerInputName: 'channel-input',
  maximumBitrate: Bitrate.mbps(20),
  routingScope: RoutingScope.REGIONAL,
  tier: RouterInputTier.INPUT_20,
  configuration: RouterInputConfiguration.mediaLiveChannel({
    channel: mediaLiveChannel,
    outputName: 'router-ts',
    pipeline: MediaLivePipeline.PIPELINE_0,
    sourceTransitDecryption: { secret: transitSecret },
  }),
});
```

## Properties

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — IAM role that MediaConnect assumes to access the Secrets Manager secret.

  **Default:** a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the **Encryption** section of the module README for the generated trust policy.

  If provided, the role is used as-is; you must grant it the necessary permissions
  yourself.

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) (required) — Secrets Manager secret containing the transit encryption key.