AWS Media Services (Standalone)

Learn how to use AWS to package your media for Studio DRM.

When using AWS Media Services with Studio DRM, you can use several services to package your media depending on your business needs. Each of the different AWS services are listed in the following table along with their use cases.

🚧

This article attempts to simplify using AWS Media Services with Studio DRM.

Since AWS Media Services products evolve, we strongly recommend verifying the steps in this documentation with the documentation for each specific AWS service. A link to each service's documentation is listed in the following table.

AWS Media ServiceDescriptionUse Case
Amazon API GatewayAmazon API Gateway enables you to create and deploy your own REST and WebSocket APIs.

Allows various media services to make calls to JWP’s SPEKE API
Amazon S3Amazon Simple Storage Service (Amazon S3) is storage for the internet.

Stores files for processing and provides a space for processed files to be saved to
AWS Elemental MediaConvertAWS Elemental MediaConvert is a service that formats and compresses offline video content for delivery to televisions or connected devices.

Processes VOD assets
AWS Elemental MediaPackageAWS Elemental MediaPackage is a just-in-time video packaging and origination service that delivers highly secure, scalable, and reliable video streams to a wide variety of playback devices.

Processes both VOD and Live assets

In addition to the AWS service, you must set up an API gateway to use the SPEKE API. Also note that you must use different endpoints depending on the SPEKE version. See SPEKE Versions for more guidance.



SPEKE Versions

AWS Media Services currently use V1 and V2 of AWS’ SPEKE standard. JWP supports these versions through different URLs.

SPEKE VersionSupported URL
SPEKE V1https://speke.vudrm.tech/{client}/speke
SPEKE V2https://cpix.vudrm.tech/v2/speke/{client}

💡

We recommend using SPEKE V2 where possible as this gives you more control over the encryption used.



Implementation

Configure Media Package For Live

Use the following steps to configure Media Package:

  1. Log in to AWS.
  2. In the Console Home page, type MediaPackage into the search bar and select its result. The AWS Elemental MediaPackage page appears.

    💡

    You can also click Services > Media Services > MediaPackage.

  3. Select Channels from the left sidebar.
  4. Click Create a new channel. The Create channel page appears.
  5. In the ID field, enter a channel identifier.
  6. Click Create. The details of the newly-created channel appear.
  7. Under Origin endpoints, click Manage endpoints. The Manage endpoints page appears.
  8. In the ID field, enter an endpoint identifier.
  9. (Optional) Add a description of the endpoint.
  10. For Manifest Name, type manifest.
  11. Under the Packager settings, select the packager type from the Type dropdown menu.
Packager TypeUse Case
Apple HLSFor use with FairPlay DRM
DASH-ISOFor use with PlayReady or Widevine DRM
Microsoft SmoothFor use with PlayReady DRM
Common Media Application Format (CMAF)For use with FairPlay, PlayReady, or Widevine DRM
  1. In the Package encryption section, choose Encrypt content. The encryption settings appear.
  2. In the Resource ID field, add a resource ID.
  3. In the System IDs text box, type the appropriate DRM system identifiers.
DRM SystemIdentifier
FairPlay DRM94ce86fb-07ff-4f43-adb8-93d2fa968ca2
PlayReady DRM9a04f079-9840-4286-ab92-e65be0885f95
Widevine DRMedef8ba9-79d6-4ace-a3c8-27dcd51d21ed
  1. In the URL field, enter your API gateway URL.
  2. In the Role ARN field, enter an appropriate Amazon Resource Name.
  3. If available, select the SPEKE version. Version 2.0 is recommended.
  4. (SPEKE V2 only) Select a Video/Audio encryption preset.
  5. Click Save.

💡

You can use the JWP Stream Tester to test the endpoints URL.



Configure Media Package for VOD

Use the following steps to configure Media Package:

  1. Log in to AWS.
  2. In the Console Home page, type MediaPackage into the search bar and select its result. The AWS Elemental MediaPackage page appears.

    💡

    You can also click Services > Media Services > MediaPackage.

  1. Select Packaging groups from the left sidebar.
  2. Click Create group. The Create packaging group page appears.
  3. In the ID field, enter an endpoint identifier.
  4. Click Create. The details of the new packaging group appear.
  5. In the Manage configuration section, click Manage configurations. The Manage configurations page appears.
  6. In the ID field, enter an endpoint identifier.
  7. From the Type dropdown menu, select the packager type.
Packager TypeUse Case
Apple HLSFor use with FairPlay DRM
DASH-ISOFor use with PlayReady or Widevine DRM
Microsoft SmoothFor use with PlayReady DRM
Common Media Application Format (CMAF)For use with FairPlay, PlayReady, or Widevine DRM
  1. After configuring your packaging, click Enable DRM.
  2. In the System IDs text box, type the appropriate DRM system identifiers.
DRM SystemIdentifier
FairPlay DRM94ce86fb-07ff-4f43-adb8-93d2fa968ca2
PlayReady DRM9a04f079-9840-4286-ab92-e65be0885f95
Widevine DRMedef8ba9-79d6-4ace-a3c8-27dcd51d21ed
  1. In the URL field, enter your API gateway URL.
  2. In the Role ARN field, enter an appropriate Amazon Resource Name.
  3. If available, select the SPEKE version. Version 2.0 is recommended.
  4. If using SPEKE Version 2.0, select a Video/Audio encryption preset.
  5. Click Save.


Create a Media Convert Job

❗️

Currently, depending on the format of the key response from the SPEKE-compliant key server, the output DASH MPD will contain PSSH elements (<cenc:pssh>) that are not wrapped in ContentProtection elements (<ContentProtection>). MediaConvert will soon release a change that alters the behavior of jobs with this characteristic . If your workflow does not involve any custom workaround steps for this purpose, no further action is required.

After the change, DASH outputs will only contain PSSH elements inside of parent ContentProtection elements, regardless of key response format. MediaConvert is making this change in order to comply with DASH Industry Forum standards, which require PSSH elements to be placed in ContentProtection parent elements1.

This change only potentially requires action if you have implemented custom workaround steps in your workflow to add missing ContentProtection elements through manifest manipulation. This change may require removing or modifying these workaround steps, as they will no longer be necessary.

Use the following steps to create a MediaConvert job:

  1. Log in to AWS.
  2. In the Amazon search bar of the new tab, type MediaConvert and click MediaConvert. The AWS Elemental MediaConvert page appears.

    💡

    You can also click Services > Media Services > MediaConvert.

  1. Select Jobs from the left sidebar.
  2. Click Create a job. The Create job page appears.
  3. Under Input 1, in the Input file URL field, enter the URL of the source clip.
  4. In the side navigation under Output groups, click Add. The Add output group popup window appears.
  5. Select an output group.
Output GroupDescription
Apple HLSFor use with FairPlay DRM
DASH-ISOFor use with PlayReady or Widevine DRM
Microsoft SmoothFor use with PlayReady DRM
CMAFFor use with FairPlay, PlayReady, or Widevine DRM
  1. Click Select. A page with the group settings appears.
  2. Under Destination, click Browse. The Choose a location popup window appears.
  3. From the S3 bucket dropdown menu, select the destination S3 bucket.
  4. In the Location field, search for the S3 bucket folder. The folder should have a path similar to this format: your-bucket/your-folder-name/.
  5. Click Choose. The popup window closes.
  6. In the Destination field, append manifest to the end of the destination.
  7. From the Segment control dropdown menu, select Segmented files.
  8. Add DRM and amend the output groups based on your output type. Only use one of the following instructions:
  9. In the video settings of your output, navigate to the Video tab of the Encoding settings.
  10. Enter your Max bitrate (bits/s).
  11. In the main side navigation under Job settings, click AWS integration. The AWS integration settings appear in the main panel.
  12. Under Service access, select Use an existing service role from the Service role control dropdown menu. The Service role field appears.
  13. In the Service role field, choose the relevant IAM role.
  14. Click Create.

You will need to wait several minutes for the job to process. On the Jobs page, you can press the Refresh button to check the status of the job. Once the job is complete, a value appears in the Finish time column.


HLS

FairPlay DRM Settings

Use the following steps to configure DRM settings:

  1. Click the DRM encryption toggle. The DRM encryption section expands.
  2. From the Encryption method dropdown menu, select Sample AES.
  3. From the Key provider type dropdown menu, select SPEKE.
  4. From the Initialization vector in manifest dropdown menu, select Exclude.
  5. In the Resource ID field, enter a unique identifier for your content.

    📘

    The identifier is often referred to as the content ID. This must only contain alphanumeric characters, hyphens (-), or underscores (_).

  1. In the System ID field, enter 94ce86fb-07ff-4f43-adb8-93d2fa968ca2.
  2. In the Key provider URL field, enter your API gateway URL.


DASH / Microsoft Smooth Streaming

PlayReady / Widevine DRM Settings

Use the following steps to configure DRM settings:

  1. Click the DRM encryption toggle. The DRM encryption section expands.
  2. In the Resource ID field, enter a unique identifier for your content.

    📘

    The identifier is often referred to as the content ID. This must only contain alphanumeric characters, hyphens (-), or underscores (_).

  1. In the System IDs text box, type the appropriate DRM system identifiers.
DRM SystemIdentifier
PlayReady DRM9a04f079-9840-4286-ab92-e65be0885f95
Widevine DRMedef8ba9-79d6-4ace-a3c8-27dcd51d21ed
  1. In the Key provider URL field, enter your API gateway URL.


CMAF

FairPlay / PlayReady / Widevine DRM Settings

Use the following steps to configure DRM settings:

  1. Click the DRM encryption toggle. The DRM encryption section expands.
  2. In the Resource ID field, enter a unique identifier for your content.

    📘

    The identifier is often referred to as the content ID. This must only contain alphanumeric characters, hyphens (-), or underscores (_).

  1. In the System ID signaled in HLS text box, type an appropriate DRM system identifier.
DRM SystemIdentifier
FairPlay DRM94ce86fb-07ff-4f43-adb8-93d2fa968ca2
Widevine DRMedef8ba9-79d6-4ace-a3c8-27dcd51d21ed
PlayReady DRMNot supported by HLS
  1. In the System IDs signaled in DASH text box, type the appropriate DRM system identifiers.
DRM SytemIdentifier
FairPlay DRMNot supported by DASH
Widevine DRMedef8ba9-79d6-4ace-a3c8-27dcd51d21ed
PlayReady DRM9a04f079-9840-4286-ab92-e65be0885f95
  1. In the Key provider URL field, enter your API gateway URL.



Test Your Content

After generating your content, you can validate a Studio DRM-protected stream in your web environment using the JWP Stream Tester.

If your content is stored in S3, you must either make it accessible via a CDN or publicly accessible in order to use our stream tester.



API Gateway

Import the API from Swagger

Use the following steps to import the API:

  1. In the Amazon search bar of the new tab, search for and click API Gateway. The API Gateway page appears.

    💡

    You can also click Services > Networking & Content Delivery > API Gateway.

  1. In the REST API section, click Import. A setup page appears.
  2. Under Choose the protocol, select REST.
  3. Under Create new API, select Import from Swagger or Open API 3.
  4. Under Import from Swagger or Open API 3, paste the following JSON.
{
  "swagger": "2.0",
  "info": {
    "title": "speke proxy"
  },
  "basePath": "/speke",
  "schemes": [
    "https"
  ],
  "paths": {
    "/": {
      "post": {
        "produces": [
          "application/json"
        ],
        "parameters": [
          {
            "name": "API-KEY",
            "in": "header",
            "required": false,
            "type": "string"
          }
        ],
        "responses": {
          "200": {
            "description": "200 response"
          }
        }
      }
    }
  }
}
  1. Click Import.


API Gateway setup

  1. In the POST box, click Set up now.
  2. For the Integration type, select HTTP.
  3. Check Use HTTP Proxy integration.
  4. Set the Endpoint URL. Be sure to use the appropriate SPEKE URL.
  5. Click Save. The Method Execution page appears.
  6. Click Integration Request.
  7. Expand the HTTP Headers section.
  8. Click Add header. A row appears.
  9. In the Name field, enter API-KEY.
  10. In the Mapped from field, enter '{your-api-key}'. Be sure to surround the API key with single quotes.
  11. At the end of the row, click the checkmark to save the header.
  12. At the top of the page, click Actions > Deploy API. The Deploy API popup window appears.
  13. From the Deployment stage dropdown menu, select [New Stage].
  14. In the Stage name field, enter an appropriate name.
  15. Click Deploy. The Stage Editor page appears for the stage that has been created.

At the top of the Stage Editor page, your Invoke URL is listed. The Invoke URL can be used by other AWS services to make requests to JWP's SPEKE API.