StaticKeyEncryption

class aws_cdk.aws_mediaconnect_alpha.StaticKeyEncryption(*, algorithm, secret, role=None)

Bases: object

(experimental) Static key encryption/decryption configuration for Zixi protocol sources and outputs, and flow entitlements.

The secret must live in the same AWS account and Region as the resource (source, output, or entitlement) that uses it. MediaConnect does not support cross-account or cross-Region secrets.

Parameters:

algorithm (EncryptionAlgorithm) – (experimental) The encryption algorithm to use.
secret (ISecret) – (experimental) Secrets Manager secret containing the static encryption key.
role (Optional[IRole]) – (experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret. If provided, the role is used as-is; you must grant it the necessary permissions yourself. Default: - a scoped role is auto-created with read access to the secret (including kms:Decrypt for a customer-managed key) and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

See:

https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Stability:

experimental

ExampleMetadata:

infused

Example:

from aws_cdk.aws_mediaconnect_alpha import StaticKeyEncryption
# stack: Stack
# flow: Flow
# role: iam.IRole
# secret: secretsmanager.ISecret


entitlement = FlowEntitlement(stack, "MyEntitlement",
    flow=flow,
    description="Grant partner access to live feed",
    subscribers=["111122223333"],
    encryption=StaticKeyEncryption(
        role=role,
        secret=secret,
        algorithm=EncryptionAlgorithm.AES256
    )
)

Attributes

algorithm

(experimental) The encryption algorithm to use.

Stability:: experimental

role

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default:

a scoped role is auto-created with read access to the secret (including

kms:Decrypt for a customer-managed key) and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

Stability:: experimental

secret

(experimental) Secrets Manager secret containing the static encryption key.

Stability:: experimental