AWS mediaconnect documentation change
Summary
Updated documentation for integrating MediaConnect router I/Os with MediaLive, expanding from one-way router output to MediaLive input to include bidirectional integration (router output to MediaLive input and MediaLive channel output to router input). Added detailed encryption options section, IAM permission requirements, and troubleshooting checklist.
Security assessment
The changes add comprehensive security documentation including encryption options (automatic key management vs. AWS Secrets Manager), IAM permission requirements for MediaLive to interact with MediaConnect, and encryption matching requirements between services. However, there is no evidence this addresses a specific security vulnerability or incident - it appears to be routine documentation enhancement for a feature integration.
Diff
diff --git a/mediaconnect/latest/ug/integrate-eml-with-router.md b/mediaconnect/latest/ug/integrate-eml-with-router.md index ae397e414..4bc7271fa 100644 --- a//mediaconnect/latest/ug/integrate-eml-with-router.md +++ b//mediaconnect/latest/ug/integrate-eml-with-router.md @@ -5 +5 @@ -PrerequisitesProcedureTroubleshootingAdditional resources +PrerequisitesEncryption optionsProcedureTroubleshootingAdditional resources @@ -7 +7 @@ PrerequisitesProcedureTroubleshootingAdditional resources -# Integrating router outputs with MediaLive inputs +# Integrating router I/Os with MediaLive @@ -9 +9 @@ PrerequisitesProcedureTroubleshootingAdditional resources -You set up a router output in AWS Elemental MediaConnect so that it can send content to AWS Elemental MediaLive. With this setup, your router output can serve as an upstream input for a MediaLive channel, enabling MediaLive to process your video stream. +You can integrate your AWS Elemental MediaLive channels with your router I/Os in AWS Elemental MediaConnect. This enables you to combine the flexibility of the router with the processing and encoding capabilities of MediaLive. @@ -11 +11 @@ You set up a router output in AWS Elemental MediaConnect so that it can send con -This setup is useful when you want to: +You can connect MediaLive to your router setup in two ways: @@ -13 +13,3 @@ This setup is useful when you want to: - * Send routed content to MediaLive for processing + 1. **Use a MediaLive input as a destination for a router output** + +When you connect a router output to a MediaLive input, you can send routed content to MediaLive for processing. This is useful when you want to: @@ -17 +19,9 @@ This setup is useful when you want to: - * Maintain flexible routing control over MediaLive inputs + * Dynamically switch which routed content is sent to MediaLive for processing + + 2. **Use a MediaLive channel output as a source for a router input** + +When you connect a MediaLive channel output to a router input, you can route processed content for global distribution. This is useful when you want to: + + * Use MediaLive processing features like content normalization, SCTE-35 processing, and clip replay before routing + + * Distribute MediaLive output across regions using the router's cross-region capabilities @@ -33,0 +44,10 @@ This page describes the process from the MediaConnect perspective, assuming coor + * Your MediaLive operator has configured the necessary permissions for MediaLive to interact with MediaConnect. They can choose their preferred approach: + + * **Simple option** + +Use the `MediaLiveAccessRole`, which includes all necessary permissions for MediaLive to work with MediaConnect. This is the simplest option, and we recommend it for most use cases. For instructions, see [Create the trusted entity - simple option](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-simple.html). + + * **Complex option** + +Create your own IAM policy and role if you need more specific custom permissions. For instructions, see [Create the trusted entity - complex option](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-complex.html). + @@ -39 +59 @@ Keep in mind the following important considerations when using this feature: - * You can't update or delete the MediaLive input while it's connected to a router output in MediaConnect + * The router I/O and the MediaLive pipeline must be in the same Availability Zone and AWS Region. @@ -41 +61 @@ Keep in mind the following important considerations when using this feature: - * The MediaLive input must not be already attached to another router output in MediaConnect + * The encryption scheme on the router side must match the encryption scheme on the MediaLive side. @@ -42,0 +63 @@ Keep in mind the following important considerations when using this feature: + * You can't delete connected resources. You must disconnect them first. @@ -43,0 +65 @@ Keep in mind the following important considerations when using this feature: + * A MediaLive resource (input or channel output) can only be connected to one router I/O at a time. @@ -44,0 +67 @@ Keep in mind the following important considerations when using this feature: + * You need the appropriate MediaLive permission on the target resource (`medialive:UpdateInput` for inputs, `medialive:UpdateChannel` for channels). @@ -46 +68,0 @@ Keep in mind the following important considerations when using this feature: -## Procedure @@ -48 +69,0 @@ Keep in mind the following important considerations when using this feature: -###### To connect a router output to a MediaLive input @@ -50 +70,0 @@ Keep in mind the following important considerations when using this feature: - 1. **Verify MediaLive permissions** @@ -52 +72 @@ Keep in mind the following important considerations when using this feature: -Check with your MediaLive operator that they have the necessary permissions for MediaLive to interact with MediaConnect. They can choose their preferred approach: +## Encryption options @@ -54 +74 @@ Check with your MediaLive operator that they have the necessary permissions for - * **Simple option (recommended)** +You can use the following encryption options for content moving between MediaConnect and MediaLive: @@ -56 +76 @@ Check with your MediaLive operator that they have the necessary permissions for -Use the `MediaLiveAccessRole`, which includes all necessary permissions for MediaLive to work with MediaConnect. For instructions, see [Create the trusted entity - simple option.](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-simple.html) +Automatic encryption key @@ -58 +77,0 @@ Use the `MediaLiveAccessRole`, which includes all necessary permissions for Medi - * **Complex option** @@ -60 +79,11 @@ Use the `MediaLiveAccessRole`, which includes all necessary permissions for Medi -Create your own IAM policy and role if you need more specific custom permissions. Alternatively, you can add these specific MediaConnect permissions to an existing custom IAM policy and role. For instructions, see [Create the trusted entity - complex option](https://docs.aws.amazon.com/medialive/latest/ug/setup-trusted-entity-complex.html). +MediaConnect and MediaLive handle encryption automatically with no manual key management required. This is the simplest option, and we recommend it for most use cases. + +AWS Secrets Manager encryption key + + +Use this option if you must manage your own encryption keys. To use this option, provide the following: + + * **Role ARN** – The ARN of the IAM role that allows the service to access your encryption keys. + + * **Secret ARN** – The ARN of the secret in Secrets Manager that contains your encryption key. + @@ -62 +91,17 @@ Create your own IAM policy and role if you need more specific custom permissions - 2. **Create an input in MediaLive** + + +###### Important + +The content of the secret must be an AES-256 key in hexadecimal format. The key must have 64 digits. + +###### Note + +If you use AWS Secrets Manager encryption, make sure the encryption configuration matches on both the MediaConnect and MediaLive sides. Both services must be authorized to access the secret. + +## Procedure + +Follow the steps for the direction of integration that you want to set up. + +###### To connect a router output to a MediaLive input + + 1. **Create an input in MediaLive** @@ -66 +111,3 @@ Ask your MediaLive operator to create an input with the following settings: - * The input type must be **MediaConnect router** + * The input type must be **MediaConnect router**. + + * They must specify an Availability Zone for each pipeline. @@ -68 +115 @@ Ask your MediaLive operator to create an input with the following settings: - * They must specify an Availability Zone for each pipeline + * For a single-pipeline input, specify one Availability Zone. @@ -70 +117 @@ Ask your MediaLive operator to create an input with the following settings: - * For a single-pipeline input, specify one Availability Zone + * For a standard (dual-pipeline) input, specify two Availability Zones. @@ -72 +119 @@ Ask your MediaLive operator to create an input with the following settings: - * For a standard (dual-pipeline) input, specify two Availability Zones + * The pipeline ID must be either 0 or 1. @@ -74 +121 @@ Ask your MediaLive operator to create an input with the following settings: - * The pipeline ID must be either 0 or 1 + * Choose the encryption type. For more information, see Encryption options. @@ -76 +123 @@ Ask your MediaLive operator to create an input with the following settings: -After creation, the MediaLive input will appear in the MediaConnect console as an an available destination for your router output. +After creation, the MediaLive input appears in the MediaConnect console as an available destination for your router output. @@ -78 +125 @@ After creation, the MediaLive input will appear in the MediaConnect console as a - 3. **Create a router output in MediaConnect** + 2. **Create a router output in MediaConnect** @@ -84 +131 @@ Create or update a router output with the following settings: - * Specify the ARN of the MediaLive input that was created in step 2. + * Specify the ARN of the MediaLive input from step 1. @@ -86 +133 @@ Create or update a router output with the following settings: - * Choose how to encrypt the content as it moves from the router output to the MediaLive input. + * Specify the pipeline ID (0 or 1). @@ -88 +135 @@ Create or update a router output with the following settings: - * **Automatic encryption key** \- Choose this if you want automatic key management (recommended in most cases). With this option, MediaConnect will privately provide the key to MediaLive. + * Choose the encryption type to match the MediaLive input. For more information, see Encryption options. @@ -90 +137 @@ Create or update a router output with the following settings: - * **AWS Secrets Manager encryption key** \- Choose this if your security requirements require you to use your own encryption keys. Then, do the following: + 3. **Create a channel in MediaLive** @@ -92 +139 @@ Create or update a router output with the following settings: - * For **Role ARN** , enter the ARN of the IAM role that allows MediaConnect to access your encryption keys. +The MediaLive operator must create a MediaLive channel and attach the MediaLive input from step 1. With this setup in place, you can send video from the MediaConnect router to MediaLive. @@ -94 +140,0 @@ Create or update a router output with the following settings: - * For Secret ARN, enter the ARN of the secret in Secrets Manager that contains your encryption key. @@ -96 +141,0 @@ Create or update a router output with the following settings: -###### Important @@ -98 +142,0 @@ Create or update a router output with the following settings: -The content of the secret must be an AES-256 key in hexadecimal format. The key must have 64 digits. @@ -100 +144,3 @@ The content of the secret must be an AES-256 key in hexadecimal format. The key -###### Note +###### To connect a MediaLive channel output to a router input + + 1. **Create a MediaConnect Router output group in MediaLive** @@ -102 +148 @@ The content of the secret must be an AES-256 key in hexadecimal format. The key -When using AWS Secrets Manager encryption, you'll need to coordinate with your MediaLive team: +Ask your MediaLive operator to configure the channel with a MediaConnect Router output group with the following settings: @@ -104 +150 @@ When using AWS Secrets Manager encryption, you'll need to coordinate with your M - * The MediaLive input must use a matching Key Type and Secret ARN + * Specify an Availability Zone for each pipeline. @@ -106 +152 @@ When using AWS Secrets Manager encryption, you'll need to coordinate with your M - * Both MediaConnect and MediaLive services must have authorization to access the customer-managed secret + * Add one or more outputs to the output group. @@ -108 +154 @@ When using AWS Secrets Manager encryption, you'll need to coordinate with your M - 4. **Create a channel in MediaLive** + * Choose the encryption type. For more information, see Encryption options. @@ -110 +156,21 @@ When using AWS Secrets Manager encryption, you'll need to coordinate with your M -As the final step, the MediaLive operator must also create a MediaLive channel and attach the MediaLive input that was created in step 2. With this setup in place, you can now send video from the MediaConnect router to MediaLive. + 2. **Create a router input in MediaConnect** + +Create or update a router input with the following settings: + + * Choose **MediaLive channel** as the input type. + + * Specify the ARN of the MediaLive channel from step 1. + + * Specify the pipeline ID (0 or 1). + + * Specify the output name from the Router output group. + + * Choose the decryption type to match the MediaLive channel output. For more information, see Encryption options. + +###### Note + +You can create the router input in a disconnected state and connect it to the MediaLive channel output later. + + 3. **Start the channel and router input** + +Start both the MediaLive channel and the router input. With this setup in place, you can send processed content from MediaLive to the MediaConnect router. @@ -119 +185,3 @@ If you encounter issues with this workflow, use this checklist to identify and r - * The MediaLive input that you specified exists in your AWS account + * The MediaLive resource (input or channel) that you specified exists in your AWS account. + + * The MediaLive resource is the correct type (MediaConnect router input type for inputs, or a channel with a MediaConnect Router output group configured). @@ -121 +189 @@ If you encounter issues with this workflow, use this checklist to identify and r - * You have permissions to view resources in both MediaConnect and MediaLive + * The router I/O and the MediaLive pipeline are in the same Availability Zone and AWS Region. @@ -123 +191 @@ If you encounter issues with this workflow, use this checklist to identify and r - * The MediaLive input is of the correct type (it must be a MediaConnect router input type) + * The encryption scheme on the router side matches the encryption scheme on the MediaLive side. @@ -125 +193 @@ If you encounter issues with this workflow, use this checklist to identify and r