TransitEncryption

class aws_cdk.aws_mediaconnect_alpha.TransitEncryption(*, secret, role=None)

Bases: object

(experimental) Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.

Uses AWS Secrets Manager for key management.

The secret must live in the same AWS account and Region as the consuming resource. MediaConnect does not support cross-account or cross-Region secrets.

Trust-policy scope on routers. Router I/O ids are service-generated (unknown at synth time), and pinning the live ARN would create a CloudFormation dependency cycle — so the auto-created role pins aws:SourceArn to a wildcarded ARN (arn:...:routerInput:* / arn:...:routerOutput:*) plus aws:SourceAccount. To pin a tighter trust policy, supply your own role.

Parameters:

secret (ISecret) – (experimental) Secrets Manager secret containing the transit encryption key.
role (Optional[IRole]) – (experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret. If provided, the role is used as-is; you must grant it the necessary permissions yourself. Default: - a scoped role is auto-created with read access to the secret and a confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

See:

https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html

Stability:

experimental

ExampleMetadata:

infused

Example:

from aws_cdk.aws_mediaconnect_alpha import TransitEncryption
# stack: Stack
# media_live_channel: medialive.IChannel
# transit_secret: Secret
# must hold the same value as the channel's MediaConnectRouterSettings.shared() secret

input = RouterInput(stack, "ChannelInput",
    router_input_name="channel-input",
    maximum_bitrate=Bitrate.mbps(20),
    routing_scope=RoutingScope.REGIONAL,
    tier=RouterInputTier.INPUT_50,
    configuration=RouterInputConfiguration.media_live_channel(
        channel=media_live_channel,
        output_name="router-ts",
        pipeline=MediaLivePipeline.PIPELINE_0,
        source_transit_decryption=TransitEncryption(secret=transit_secret)
    )
)

Attributes

role

(experimental) IAM role that MediaConnect assumes to access the Secrets Manager secret.

If provided, the role is used as-is; you must grant it the necessary permissions yourself.

Default:

a scoped role is auto-created with read access to the secret and a

confused-deputy trust condition. See the Encryption section of the module README for the generated trust policy.

Stability:: experimental

secret

(experimental) Secrets Manager secret containing the transit encryption key.

Stability:: experimental