AWS mediapackage documentation change
Summary
Added documentation for Microsoft Smooth Streaming (MSS) manifests, including ISM container requirements, PlayReady DRM limitations, and new 'Exclude segment DRM metadata' option for CMAF containers
Security assessment
The changes add documentation about DRM encryption limitations (PlayReady-only support for ISM, no key rotation) and a new security-related configuration option to exclude DRM metadata boxes. While these clarify security constraints, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/mediapackage/latest/userguide/endpoints-create.md b/mediapackage/latest/userguide/endpoints-create.md index 52f0e2d19..bad115dd5 100644 --- a//mediapackage/latest/userguide/endpoints-create.md +++ b//mediapackage/latest/userguide/endpoints-create.md @@ -53,0 +54,2 @@ The container type options are: + * ISM (available for MSS manifests only. Note: MSS only supports PlayReady DRM, does not support SCTE-35, key rotation, or constant IV) + @@ -139,0 +142,4 @@ To encrypt content, you must have a DRM provider, and be set up to use encryptio + * The valid encryption method for ISM container types is: + + * CENC + @@ -157,0 +164,4 @@ The valid DRM systems for CMAF container types are: +The valid DRM system for ISM container types is: + + * PlayReady + @@ -176 +186 @@ The following example shows a role ARN. - 7. For **Video encryption preset** and **Audio encryption preset** , select the preset for encryptiong audio and video. For information about presets, see [Encryption presets in AWS Elemental MediaPackage](./drm-content-speke-v2-presets.html). + 7. For **Video encryption preset** and **Audio encryption preset** , select the preset for encrypting audio and video. For information about presets, see [Encryption presets in AWS Elemental MediaPackage](./drm-content-speke-v2-presets.html). @@ -187,0 +198,8 @@ For information about key rotation, see [AWS Elemental MediaPackage key rotation + 10. (Optional) Select **Exclude segment DRM metadata** to omit SEIG and SGPD boxes from CMAF segments. This can improve compatibility with certain devices and players that don't support these DRM metadata boxes. + +###### Note + +This option is only available for CMAF container formats. For TS containers, this option is disabled because TS containers don't include SEIG and SGPD boxes. + +When enabled, MediaPackage excludes segment-level DRM metadata boxes while preserving other essential DRM functionality. Key rotation can still be handled through media playlist signaling. For more information about DRM segment metadata, see [Managing DRM segment metadata](./drm-segment-metadata-management.html). + @@ -210 +228,19 @@ The manifests fields hold general information about the manifest. You must attac -Choose the type of manifest to use. You can choose an HLS manifest, LL-HLS manifest, or DASH manifest. +Choose the type of manifest to use. You can choose an HLS manifest, LL-HLS manifest, DASH manifest, or MSS manifest. The available manifest types depend on the container type you selected: + + * TS container: HLS and LL-HLS manifests + + * CMAF container: HLS, LL-HLS, and DASH manifests + + * ISM container: MSS manifests only + +###### Note + +Microsoft Smooth Streaming (MSS) is primarily used for legacy devices such as older smart TVs, Xbox consoles, and platforms that use Microsoft Silverlight. If you need to support these devices, select the ISM container type and create an MSS manifest. For more information about MSS, see [MSS in AWS Elemental MediaPackage](./mss-overview.html). + + + + +###### Topics + + + @@ -495,0 +532,110 @@ If you're using this setting to limit content playback for contractual reasons, +This topic shows you how to configure an endpoint in AWS Elemental MediaPackage to create Microsoft Smooth Streaming (MSS) manifests. MSS manifests require the ISM container type. + +###### MSS requirements and limitations + +When creating an MSS manifest, note the following requirements and limitations: + +**Configuration requirements** + + * You must select ISM as the container type + + * Only PlayReady DRM is supported for encryption + + + + +**Feature limitations** + + * SCTE-35 is not supported + + * Key rotation is not supported for encrypted content + + * Lookahead fragments are automatically set to 2 and are not configurable + + * CDK constructs support may be limited (contact AWS Support for current status) + + * Auto support for ISM constructs is not enabled + + + + +**Technical specifications** + + * URLs end with `.ism/Manifest` instead of `.html` + + * Manifest MIME type is `text/xml` + + + + +For information about URL limits and endpoint quotas, see [Quotas in AWS Elemental MediaPackage](./quotas.html). + +###### To create an MSS manifest + + 1. For **Manifest name** , enter a short string that will be appended to the endpoint URL. The manifest name creates a unique path to this endpoint. If you don't enter a value, MediaPackage uses the default manifest name, _index_. MediaPackage automatically inserts the format extension, such as .isml. Supported characters are **A-Z** , **a-z** , **0-9** , and **-** (hyphen). You can't use underscores in the name. + + 2. For **Manifest window (sec.)** enter the total duration (in seconds) of the manifest's content. The default value is 60 seconds. The maximum manifest window is 900 seconds (15 minutes). You can request a quota increase if necessary. + + 3. For **Manifest layout** , choose how MediaPackage formats the manifest: + + * **Full** – Each fragment in the sequence has an explicit value for the duration field and an implicit value for the time field, except the first fragment, whose start-time is explicit. + + * **Compact** – Uses the FragmentRepeat field on segments that share the same attributes and length to reduce manifest size. This can significantly reduce manifest length for streams with consistent segment durations. + +For most use cases, **Compact** is recommended as it reduces manifest size and network overhead. + + 4. For **Lookahead fragment count** , the value is automatically set to 2 and cannot be changed for MSS manifests. This buffer helps ensure smooth playback. + +MSS includes the concept of server lookahead, where a buffer of segments is held back by the server until future segments are available. This means that segments right at the live edge will not be included in the manifest until the specified number of lookahead fragments are internally available. + +The lookahead is ignored when the stream has ended or when there's a discontinuity between segments. + + 5. Select **Enable filter configuration** if you want to optionally add filters and settings to modify manifests. These filters apply to all manifests that originate from this endpoint. + +To automatically fill these values from an existing query string, choose **Import from query string**. + +###### Note + +When you include a Manifest filter, you cannot use matching query parameters for the manifest's endpoint URL. If you do, you will receive a `404` HTTP error code instead. + +**Manifest filter** + + +Optionally specify one or more manifest filters for all of your manifest egress requests. + +You enter a **Filter key** and **Filter value** pair for each manifest filter. Your filter values can be a range, single value, or combination of both. + +For a list of supported keys and values, see [Manifest filtering query parameters](./manifest-filter-query-parameters.html). + +**Start time and End time** + + +Optionally specify the start or end time for all of your manifest egress requests. To use this setting, you must have a startover window defined. + +For more information about start and end times, see [Start and end parameters](./start-and-end-parameters-rules.html). + +If you enter a start or end time using the API, or import using **Import from query string** in the MediaPackage console, enter dates in an ISO-8601 format. + +**Time delay** + + +Optionally specify the time delay (in seconds) for all of your manifest egress requests. To use this setting, you must have a startover window defined. + +For more information about using time delays, see [Time delay](./time-delay.html). + +**Clip start time data and time** + + +When using a time delay, optionally specify the clip start time for all of your manifest egress requests. This option specifies the earliest content that can be included in the manifest. Content ingested before the clip start time will not be included in the manifest. Cannot be used with start time or end time filters. To use this setting, you must have a startover window defined. + +For more information about clip start and time delay, see [Using clip start with time delay](./time-delay.html#clip-start). + +###### Important + +If you're using this setting to limit content playback for contractual reasons, this parameter should be set at your CDN, and not at the client. + + + + +After you've configured your MSS manifest, choose **Create** to create the endpoint. For information about testing your MSS endpoint, see [Testing MSS playback in AWS Elemental MediaPackage](./mss-testing-playback.html). For troubleshooting information, see [Troubleshooting MSS endpoints in AWS Elemental MediaPackage](./mss-troubleshooting.html). +