AWS mediaconnect documentation change
Summary
Restructured documentation to add detailed step-by-step procedures for integrating MediaConnect with MediaLive, including prerequisites, permission verification, and coordination steps
Security assessment
The changes add documentation about IAM role requirements (MediaLiveAccessRole) and permission verification processes, which are security-related configurations. However, there is no evidence this addresses a specific security vulnerability - it's standard security documentation for service integration.
Diff
diff --git a/mediaconnect/latest/ug/distribution-to-medialive.md b/mediaconnect/latest/ug/distribution-to-medialive.md index fac70faca..ac0387efe 100644 --- a//mediaconnect/latest/ug/distribution-to-medialive.md +++ b//mediaconnect/latest/ug/distribution-to-medialive.md @@ -5 +5 @@ -Billing considerations +PrerequisitesProcedureBilling considerations @@ -9 +9 @@ Billing considerations -If you plan to distribute the contents of your AWS Elemental MediaConnect flow to AWS Elemental MediaLive, remember the following: +You can set up a flow in AWS Elemental MediaConnect so that it can distribute content to AWS Elemental MediaLive. With this setup, your MediaConnect flows can serve as upstream inputs for MediaLive channels, enabling MediaLive to process your video streams. @@ -11 +11 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - * For each video stream, create two flows in the same AWS Region, and in the same Availability Zones (such as `us-east-1a`). For example, if you are creating two MediaLive inputs using MediaConnect flows, the first flow of input 1 needs to be in the same Availability Zone as the first flow of input 2. These redundant flows will serve as the primary and backup inputs for the MediaLive channel. +## Prerequisites @@ -13 +13 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - * Create the MediaLive channel in the same AWS Region as the AWS Elemental MediaConnect flows. +Before you begin, ensure that: @@ -15 +15 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - * Set up permissions that allow MediaLive to communicate with AWS Elemental MediaConnect. This process consists of the following procedures: + * You have administrator permissions for MediaConnect @@ -17 +17 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 1. Create a policy that allows MediaLive to submit a request to AWS Elemental MediaConnect (see [Create a MediaLive Policy](https://docs.aws.amazon.com/medialive/latest/ug/permissions-medialive-step1.html)). + * You can coordinate with someone who has administrator permissions for MediaLive @@ -19 +18,0 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 2. Assign that policy to a role for MediaLive (see [Create a Role for MediaLive](https://docs.aws.amazon.com/medialive/latest/ug/permissions-medialive-step2.html)). You will need the Amazon Resource Name (ARN) for this role when you specify AWS Elemental MediaConnect flows as inputs to a MediaLive channel. @@ -21 +19,0 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - * Create your AWS Elemental MediaConnect and MediaLive resources in this order: @@ -23 +20,0 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 1. Set up permissions. @@ -25 +22 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 2. Create the AWS Elemental MediaConnect flows. +###### Note @@ -27 +24 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 3. Make a note of the flow ARNs. +This page describes the process from the MediaConnect perspective, assuming coordination with someone managing MediaLive. One person can perform both roles if they have the necessary permissions. @@ -29 +26 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t - 4. Create the inputs on the MediaLive channel. (You can create the MediaLive channel whenever you want. Just be sure to create the inputs for that channel after you create the flows.) +## Procedure @@ -30,0 +28 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t + * Step 1: Verify MediaLive permissions @@ -31,0 +30 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t + * Step 2: Get the MediaLive channel details @@ -32,0 +32,151 @@ If you plan to distribute the contents of your AWS Elemental MediaConnect flow t + * Step 3. Set up MediaConnect flows + + * Step 4: Connect with MediaLive and start your flows + + * Step 5: Start the MediaLive channels + + + + +### Step 1: Verify MediaLive permissions + +To use MediaConnect flows as inputs for MediaLive channels, first ensure MediaLive has the necessary permissions to work with your flows. This is a one-time setup. + +###### To verify permissions + + * Check with your MediaLive operator that they’ve set up the necessary permissions for MediaLive to interact with your MediaConnect flows. They can choose their preferred approach: + + * **Simple option (recommended)** + +Use the `MediaLiveAccessRole`, which includes all necessary permissions for MediaLive to work with MediaConnect. For instructions, see [Create the trusted entity - simple option](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-simple.html). + + * **Complex option** + +Create your own IAM policy and role if you need more specific custom permissions. Alternatively, you can add these specific MediaConnect permissions to an existing custom IAM policy and role. For instructions, see [Create the trusted entity - complex option](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-complex.html). + + + + +###### Result of this step + +MediaLive now has the permissions needed to work with your flows, including creating and removing outputs and reading flow information. You can reuse this role for multiple channels and flows. + +### Step 2: Get the MediaLive channel details + +Before you configure your flows, you need specific information about the MediaLive channel they'll connect to. The channel settings determine which AWS Region and Availability Zones you'll use for your flows. + +###### To get the channel details + + 1. Coordinate with your MediaLive operator to get information about their channel. They can either use an existing channel, or [create a new channel](https://docs.aws.amazon.com/medialive/latest/ug/creating-channel-scratch.html) if they don’t have one already. + + 2. Ask them to provide you with the following information about the channel: + + * AWS Region + + * Availability Zones + + * Channel type (single-pipeline or dual-pipeline) + + + + +###### Result of this step + +You now have the information needed to create your flows in the correct AWS Region and Availability Zones. + +### Step 3. Set up MediaConnect flows + +In this step, you create new flows (or identify existing ones) to serve as inputs for the MediaLive channel. + +###### To set up the flows + + 1. Sign into the MediaConnect console. + + 2. Determine how many flows you need based on the MediaLive channel type: + + * **For a single-pipeline channel** + +You’ll need one flow in the same Availability Zone as the channel. + + * **For a standard (dual-pipeline) channel** + +You’ll need two flows in different Availability Zones (matching the two MediaLive channel Availability Zones). + + 3. Decide whether to use existing flows or create new ones. + + * **If you’re using existing flows** + +Check that your flows meet these requirements: + + * They’re in the same Region as the MediaLive channel. + + * They have the correct number and placement of Availability Zones (as determined in step 2). + + * They have sufficient bandwidth capacity. + + * They haven’t reached their maximum number of outputs. (MediaLive automatically creates an output on each flow when you create an input in MediaLive). + +If these requirements are met, skip to step 4. Otherwise, create new flows. + + * **If you’re creating new flows** + +[Create flows](https://docs.aws.amazon.com/mediaconnect/latest/ug/flows-create.html) in the same AWS Region as the MediaLive channel, ensuring the correct Availability Zone placement (as determined in step 2). + +###### Tip + +If you’re creating two flows, use names that are identical except for a suffix. For example, `sports_event_A` and `sports_event_B`. This will help the MediaLive operator match the flows to the input pipelines in MediaLive. + + 4. Take note of the Amazon Resource Name (ARN) for your flows, and share this information with the MediaLive operator. The flow ARNs look like this: + + * `arn:aws:mediaconnect:us-west-1:111122223333:flow:1bgf67:sports_event_A` + + * `arn:aws:mediaconnect:us-west-1:111122223333:flow:9pmlk76:sports_event_B` + + + + +###### Result of this step + +Your flows are in the correct Region and Availability Zones, and are ready to connect to MediaLive inputs. + +### Step 4: Connect with MediaLive and start your flows + +Now that your flows are ready, you can provide their details to MediaLive and start them. + +###### To connect with MediaLive and start your flows + + 1. Coordinate with your MediaLive operator: + + * Provide them the flow ARNs from Step 3. Set up MediaConnect flows. + + * Inform them they can now create a MediaConnect input on the MediaLive channel using these flow ARNs. + + 2. In MediaConnect, start each flow that you set up in Step 3. Set up MediaConnect flows. + + + + +###### Note + +You can start your flows before or after MediaLive creates their input - the order doesn't matter. MediaLive can add outputs to either a running flow or one that hasn't started yet. + +###### Result of this step + +MediaLive automatically creates two endpoints on the input (even for single-pipeline channels) and establishes connections to your MediaConnect flows. Your flows are now running and ready to receive content from upstream sources. + +### Step 5: Start the MediaLive channels + +After the MediaConnect flow is started, the final step is to start the MediaLive channel. + +###### To start the MediaLive channel + + * Inform the MediaLive operator that they can now [start the channel](https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html) that’s configured to use the MediaConnect inputs. + + + + +###### Result of this step + +The MediaLive channel starts ingesting content from your flows and processing it according to the channel's configuration. + +This completes the setup process. Your MediaConnect flows are now serving as inputs for the MediaLive channel.