AWS mediaconnect documentation change
Summary
Restructured documentation with expanded prerequisites, added NDI configuration guidance, and clarified flow creation steps. Added security group recommendations for NDI servers and encryption setup requirements.
Security assessment
Added explicit security documentation for IAM trusted service setup, encryption requirements, and security group configuration recommendations (including self-referencing rules). However, there's no evidence these changes address a specific security vulnerability.
Diff
diff --git a/mediaconnect/latest/ug/flows-create-vpc-source.md b/mediaconnect/latest/ug/flows-create-vpc-source.md index 297888e37..c3ec29563 100644 --- a/mediaconnect/latest/ug/flows-create-vpc-source.md +++ b/mediaconnect/latest/ug/flows-create-vpc-source.md @@ -5 +5 @@ -Transport stream flow, VPC source (console)Additional resources +PrerequisitesProcedureNext stepsAdditional resources @@ -13 +13,18 @@ When you create a flow that uses a source from your virtual private cloud (VPC), -###### Important +## Prerequisites + +Before you begin, make sure you've completed the following steps: + +**VPC configuration** + + +In Amazon VPC, set up your VPC and associated security groups. For more information about VPCs, see the [Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/). For information about configuring security groups to work with your VPC interface, see [Security group considerations](./vpc-interface-security-groups.html). + +**IAM setup** + + +In IAM, [set up MediaConnect as a trusted service](./security-iam-trusted-entity.html). + +**Encryption setup (if required)** + + +If the source of your flow requires encryption, [set up encryption](./encryption-static-key-set-up.html). @@ -15 +32 @@ When you create a flow that uses a source from your virtual private cloud (VPC), -Before you begin this procedure, make sure that the following steps have been completed: +**NDI® configuration (for NDI use cases only)** @@ -17 +33,0 @@ Before you begin this procedure, make sure that the following steps have been co - * In Amazon VPC, set up your VPC and associated security groups. For more information about VPCs, see the [Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/). For information about configuring security groups to work with your VPC interface, see [Security group considerations](./vpc-interface-security-groups.html). @@ -19 +35 @@ Before you begin this procedure, make sure that the following steps have been co - * In IAM, [set up MediaConnect as a trusted service](./security-iam-trusted-entity.html). +We recommend reviewing the [NDI outputs](./outputs-using-ndi.html) documentation to familiarize yourself with this feature before getting started. @@ -21 +37 @@ Before you begin this procedure, make sure that the following steps have been co - * If the source of your flow requires encryption, [set up encryption](./encryption-static-key-set-up.html). +If you want to add an NDI output to your flow, you need a VPC with NDI discovery servers provisioned in your network. MediaConnect connects to these servers, but it doesn't create them for you. @@ -22,0 +39 @@ Before you begin this procedure, make sure that the following steps have been co + * AWS provides guidance on automated setup across multiple Availability Zones using AWS CloudFormation, including best practices for installation and configuration. For instructions, see [Setting Up NDI Discovery Servers for Broadcast Workflows](https://aws.amazon.com/solutions/guidance/programmatic-deployment-of-ndi-discovery-servers-for-broadcast-workflows-on-aws/). @@ -23,0 +41 @@ Before you begin this procedure, make sure that the following steps have been co + * We recommend that you configure your security groups with a self-referencing ingress rule and egress rule. You can then attach this security group to the EC2 instances where your NDI servers are running within the VPC. This approach automatically allows all necessary NDI communication between components in your VPC, and all required network traffic is permitted. For guidance on setting up self-referencing security group rules, see [Security Group Referencing](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html#security-group-referencing) in the Amazon VPC User Guide. @@ -26 +44,5 @@ Before you begin this procedure, make sure that the following steps have been co -## Create a transport stream flow that uses a VPC source (console) + + +## Procedure + +###### To create a transport stream flow that uses a VPC source (console) @@ -40 +62,17 @@ MediaConnect allows you to create multiple flows with the same name. However, we - 5. In the **Source** section, for **Source type** , choose **VPC source**. + 5. Under **Flow size** , select the size that matches your use case. For more information about flow sizes, see [Flow sizes and capabilities](./flow-sizes-capabilities.html). + +**For medium flows:** + + * Proceed directly to step 6. + +**For large flows:** + + * If you don't need NDI outputs for your flow, proceed directly to step 6. + + * If you want to add NDI outputs to your flow, configure the NDI settings as follows: + + 1. Set **Flow NDI support** to **Enabled**. + + 2. (Optional) Enter an **NDI machine name**. + + * This name is used as a prefix to help you identify the NDI sources that your flow creates. For example, if you enter `MACHINENAME`, your NDI sources will appear as `MACHINENAME` `(ProgramName)`. @@ -42 +80 @@ MediaConnect allows you to create multiple flows with the same name. However, we - 6. For **Name** , specify a name for your source. This value is an identifier that is visible only on the MediaConnect console. + * If you don’t enter a name, MediaConnect generates a unique 12-character ID as the prefix. This ID is derived from the flow's Amazon Resource Name (ARN), so the machine name references the flow resource. @@ -44 +82,21 @@ MediaConnect allows you to create multiple flows with the same name. However, we - 7. Determine which protocol your source uses. +###### Tip + +Thoughtful naming is especially important when you have multiple flows creating NDI sources. For example, a production environment with 100 NDI sources would benefit from clear, descriptive machine name prefixes like `STUDIO-A`, `STUDIO-B`, `NEWSROOM`, and so on. + + 3. Add up to three **NDI discovery servers**. For each server, provide the following information: + + * Enter the server IP address from your existing NDI infrastructure. + + * Select the VPC interface adapter to control network access. + + * (Optional) Specify a port number. If you leave this blank, MediaConnect uses the NDI Discovery server default of TCP-5959. + +###### Tip + +You can add up to three discovery servers. Having multiple discovery servers improves reliability and helps ensure your NDI sources are discoverable across your network. + + 6. In the **Source** section, for **Source type** , choose **VPC source**. + + 7. For **Name** , specify a name for your source. This value is an identifier that is visible only on the MediaConnect console. + + 8. Determine which protocol your source uses. @@ -50 +108 @@ If you want to specify redundant sources for failover, create the flow with one - 8. For specific instructions based on your protocol, choose one of the following tabs: + 9. For specific instructions based on your protocol, choose one of the following tabs: @@ -171 +229 @@ If you leave this field blank, the service uses the source name as the stream ID - 9. For each VPC that you want to connect to the flow, do the following: + 10. For each VPC that you want to connect to the flow, do the following: @@ -189 +247 @@ If you don't see the VPC that you want in the list, verify that the VPC has been - 10. Under **Source monitoring configuration** , choose which monitoring features you want to enable. + 11. Under **Source monitoring configuration** , choose which monitoring features you want to enable. @@ -203 +261 @@ If you don't see the VPC that you want in the list, verify that the VPC has been - 11. At the bottom of the page, choose **Create flow**. + 12. At the bottom of the page, choose **Create flow**. @@ -205 +262,0 @@ If you don't see the VPC that you want in the list, verify that the VPC has been -###### Note @@ -207 +263,0 @@ If you don't see the VPC that you want in the list, verify that the VPC has been -The flow doesn't start automatically. You must [start the flow](./flows-start.html) manually. @@ -209 +265,10 @@ The flow doesn't start automatically. You must [start the flow](./flows-start.ht - 12. [Add outputs](./outputs-add.html) to specify where you want MediaConnect to send the content, or [grant entitlements](./entitlements-grant.html) to allow users of other AWS accounts to subscribe to your content. + +## Next steps + +Now that you've created a flow, complete these steps to start delivering your content: + + * [Add outputs](./outputs-add.html) to specify where you want MediaConnect flow to send your content + + * [Grant entitlements](./entitlements-grant.html) to allow users of other AWS accounts to subscribe to your content + + * [Start your flow](./flows-start.html) to begin content delivery @@ -216 +281,8 @@ The flow doesn't start automatically. You must [start the flow](./flows-start.ht -For more information about source monitoring options, see [Viewing thumbnails of the source video](./monitor-with-thumbnails.html) and [Monitoring with content quality analysis in AWS Elemental MediaConnect](./monitor-content-quality-analysis.html). +For more information about source monitoring options for your flow, see the following pages in this guide: + + * [Viewing thumbnails of the source video](./monitor-with-thumbnails.html) + + * [Monitoring with content quality analysis in AWS Elemental MediaConnect](https://docs.aws.amazon.com/mediaconnect/latest/ug/monitor-content-quality-analysis.html) + + +