AWS mediaconnect medium security documentation change
Summary
Added prerequisites for NDI configuration including VPC setup, security group recommendations, and detailed procedure for flow creation with NDI outputs. Expanded availability zone selection guidance and flow size considerations.
Security assessment
Added explicit guidance about configuring security groups with self-referencing ingress/egress rules for NDI servers. This addresses network security best practices for allowing required NDI communication within a VPC.
Diff
diff --git a/mediaconnect/latest/ug/flows-create-entitled-source.md b/mediaconnect/latest/ug/flows-create-entitled-source.md index 33ea32115..f9b2323fd 100644 --- a/mediaconnect/latest/ug/flows-create-entitled-source.md +++ b/mediaconnect/latest/ug/flows-create-entitled-source.md @@ -5 +5 @@ -Transport stream flow, entitled source (console)Additional resources +PrerequisitesProcedureNext stepsAdditional resources @@ -11 +11,20 @@ Transport stream flows transport compressed content that is muxed into a single -## Create a transport stream flow that uses an entitled source (console) +## Prerequisites + + * **NDI® configuration (for NDI use cases only)** + +We recommend reviewing the [NDI outputs](./outputs-using-ndi.html) documentation to familiarize yourself with this feature before getting started. + +If you want to add an NDI output to your flow, you need a VPC with NDI discovery servers provisioned in your network. MediaConnect connects to these servers, but it doesn't create them for you. + + * For a quick start with VPCs, you can use our [AWS CloudFormation VPC template](https://docs.aws.amazon.com/vpc/latest/userguide/create-vpc.html) to automatically create a VPC with public and private subnets. For more information about VPCs, see the [Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/). + + * For NDI discovery server deployment, AWS provides guidance on automated setup across multiple Availability Zones using AWS CloudFormation, including best practices for installation and configuration. For instructions, see [Setting Up NDI Discovery Servers for Broadcast Workflows](https://aws.amazon.com/solutions/guidance/programmatic-deployment-of-ndi-discovery-servers-for-broadcast-workflows-on-aws/). + + * We recommend that you configure your security groups with a self-referencing ingress rule and egress rule. You can then attach this security group to the EC2 instances where your NDI servers are running within the VPC. This approach automatically allows all necessary NDI communication between components in your VPC, and all required network traffic is permitted. For guidance on setting up self-referencing security group rules, see [Security Group Referencing](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-referencing) in the Amazon VPC User Guide. + + + + +## Procedure + +###### To create a transport stream flow that uses an entitled source (console) @@ -23 +42,7 @@ MediaConnect allows you to create multiple flows with the same name. However, we - 4. For **Availability Zone** , choose an Availability Zone for your flow. Use this option when you are setting up redundant flows. Otherwise, you can leave this as **Any**. If you leave the default, the service will randomly assign an Availability Zone within the current AWS Region , or if your source comes from a VPC, the service will assign the Availability Zone of the VPC subnet to the flow. + 4. For **Availability Zone** , choose one of the following options: + + * Select **Any** (recommended) + + * Select a specific Availability Zone (useful if you're setting up redundant flows) + +If you use the default setting (**Any**), MediaConnect will randomly assign an Availability Zone within the current AWS Region. If your source comes from a VPC, the service will assign the Availability Zone of the VPC subnet to the flow. @@ -29 +54,19 @@ If your source comes from your VPC, the Availability Zone of your flow must matc - 5. In the **Source** section, for **Source type** choose **Entitled source**. + 5. Under **Flow size** , select the size that matches your use case. For more information about flow sizes, see [Flow sizes and capabilities](./flow-sizes-capabilities.html). + +**For medium flows:** + + * Proceed directly to step 6. + +**For large flows:** + + * If you don't need NDI outputs for your flow, proceed directly to step 6. + + * If you want to add NDI outputs to your flow, configure the NDI settings as follows: + + 1. Set **Flow NDI support** to **Enabled**. + + 2. (Optional) Enter an **NDI machine name**. + + * This name is used as a prefix to help you identify the NDI sources that your flow creates. For example, if you enter `MACHINENAME`, your NDI sources will appear as `MACHINENAME` `(ProgramName)`. + + * If you don’t enter a name, MediaConnect generates a unique 12-character ID as the prefix. This ID is derived from the flow's Amazon Resource Name (ARN), so the machine name references the flow resource. @@ -31 +74,21 @@ If your source comes from your VPC, the Availability Zone of your flow must matc - 6. For **Entitlement ARN** , choose the appropriate entitlement. This list includes all entitlements that have been granted to you. +###### Tip + +Thoughtful naming is especially important when you have multiple flows creating NDI sources. For example, a production environment with 100 NDI sources would benefit from clear, descriptive machine name prefixes like `STUDIO-A`, `STUDIO-B`, `NEWSROOM`, and so on. + + 3. Add up to three **NDI discovery servers**. For each server, provide the following information: + + * Enter the server IP address from your existing NDI infrastructure. + + * Select the VPC interface adapter to control network access. + + * (Optional) Specify a port number. If you leave this blank, MediaConnect uses the NDI Discovery server default of TCP-5959. + +###### Tip + +You can add up to three discovery servers. Having multiple discovery servers improves reliability and helps ensure your NDI sources are discoverable across your network. + + 6. In the **Source** section: + + * For **Source type** , choose **Entitled source**. + + * For **Entitlement ARN** , choose the appropriate entitlement. This list includes all entitlements that have been granted to you. @@ -53 +115,0 @@ You can click in this field and start entering the entitlement name. MediaConnec -###### Note @@ -55 +116,0 @@ You can click in this field and start entering the entitlement name. MediaConnec -The flow doesn't start automatically. You must [start the flow](./flows-start.html) manually. @@ -57 +118,10 @@ The flow doesn't start automatically. You must [start the flow](./flows-start.ht - 9. [Add outputs](./outputs-add.html) to specify where you want MediaConnect to send the content, or [grant entitlements](./entitlements-grant.html) to allow users of other AWS accounts to subscribe to your content. + +## Next steps + +Now that you've created a flow, complete these steps to start delivering your content: + + * [Add outputs](./outputs-add.html) to specify where you want MediaConnect flow to send your content + + * [Grant entitlements](./entitlements-grant.html) to allow users of other AWS accounts to subscribe to your content + + * [Start your flow](./flows-start.html) to begin content delivery @@ -64 +134,8 @@ The flow doesn't start automatically. You must [start the flow](./flows-start.ht -For more information about source monitoring options, see [Viewing thumbnails of the source video](./monitor-with-thumbnails.html) and [Monitoring with content quality analysis in AWS Elemental MediaConnect](./monitor-content-quality-analysis.html). +For more information about source monitoring options for your flow, see the following pages in this guide: + + * [Viewing thumbnails of the source video](./monitor-with-thumbnails.html) + + * [Monitoring with content quality analysis in AWS Elemental MediaConnect](https://docs.aws.amazon.com/mediaconnect/latest/ug/monitor-content-quality-analysis.html) + + +