Lab
  • DRM packaging tutorialsCourse
  • 5 things you need to know about multi-DRMCourse
  • Getting started with DoveRunner Anti PiracyCourse
  • Getting started with DoveRunner Forensic WatermarkingCourse
  • Getting started with DoveRunner Mobile App SecurityCourse
  • Getting started with DoveRunner Multi-DRMCourse
  • Getting started with DoveRunner Transcoding & PackagingCourse
  • Packaging content with the DRM CLI PackagerLesson · DRM packaging tutorials
↑↓ Navigate↵ Openesc CloseTop 8 of 33 results
한국어
Start free trial

Multi-DRM packaging with AWS Elemental MediaConvert

Shows, with a real job run, how one AWS Elemental MediaConvert job produces DRM-encrypted DASH and HLS with DoveRunner Multi-DRM.

Lesson 25 min

DRM: —Status: idle

What you will build

If you already package video with AWS Elemental MediaConvert, you can add DoveRunner Multi-DRM to the same job. MediaConvert reads your source file from S3 and, for each output, asks the DoveRunner key server for encryption keys using the SPEKE protocol. It then writes encrypted DASH and HLS back to S3. DASH carries PlayReady and Widevine; HLS carries FairPlay. Your players get licenses from DoveRunner. The video above is the output of this exact job.

Before you start

  • AWS account with access to IAM, S3, and MediaConvert
  • DoveRunner Console account (console.doverunner.com) for your KMS token
  • A content ID (CID) of your choice. You enter it as the Resource ID in MediaConvert and use the same CID in your license integration
  • A source video in S3
  • MediaConvert DRM encryption is a Pro feature of the MediaConvert job settings
DRM system System ID
PlayReady 9a04f079-9840-4286-ab92-e65be0885f95
Widevine edef8ba9-79d6-4ace-a3c8-27dcd51d21ed
FairPlay 94ce86fb-07ff-4f43-adb8-93d2fa968ca2

1. Get the KMS token

In DoveRunner Console, go to Multi DRM > Settings and select Retrieve Secret Information. Your KMS token appears in the KMS Token row. Treat it like a password: it goes only into the key provider URL of the MediaConvert job.

The key provider URL has this form:

https://drm-kms.doverunner.com/v1/cpix/getKey?enc-token=<KMS token>

2. Create the IAM role

MediaConvert needs permission to use your S3 buckets. In the AWS IAM console, go to Roles > Create role, choose AWS service, and select MediaConvert as the use case. This use case already attaches AmazonS3FullAccess and AmazonAPIGatewayInvokeFullAccess, so there is nothing to pick. Name the role MediaConvert-role and create it.

3. Create the job and set the input

In the MediaConvert console, go to Jobs > Create job. Under Input, enter the S3 URL of your source video. Leave Follow source on so the output keeps the source's resolution and aspect ratio.

4. DASH output group (PlayReady + Widevine)

  1. Select Add output group and choose DASH ISO.
  2. Name the group, and set Destination to a path in your output bucket, for example s3://<bucket>/lab-contents/<cid>/dash/stream.
  3. Keep the two default outputs: one H.264 video, one AAC audio. Widevine needs video and audio in separate files.
  4. Turn on DRM encryption and set:
    • Resource ID: your CID
    • SPEKE version: 1.0
    • System ID: the PlayReady and Widevine IDs, one per line (two at most)
    • Key provider URL: the URL from step 1
    • Certificate ARN: leave blank
    • Playback device compatibility: CENC v1

5. HLS output group (FairPlay)

Add a second output group, Apple HLS, with its own destination (for example .../<cid>/hls/master). Turn on DRM encryption, choose Sample AES as the encryption method and SPEKE as the key provider type. Enter the same Resource ID and key provider URL, with the FairPlay system ID.

This HLS output is protected with FairPlay (Sample AES), not CENC. FairPlay playback needs a Safari/Apple client and FairPlay set up on the DoveRunner side.

6. Service role and the two common errors

Under AWS integration, choose Use an existing service role and select MediaConvert-role, then select Create. Two validation errors can stop you:

  • maxBitrate is a required property: set Max bitrate on each H.264 output (this lesson uses 5,000,000 bits/s)
  • nameModifier is a required property: set a Name modifier (for example _1080p) on the HLS output

Fix both and create the job again.

7. Run the job

The job moves from Submitted to Progressing to Complete. Transcoding the 12-minute source took about 5 minutes. You may see two warnings about missing color metadata in the source (230001, 230005); they don't stop the job.

8. Verify the output

In your output bucket you find a dash/ and an hls/ folder.

  • DASH (dash/stream.mpd): ContentProtection entries for PlayReady and Widevine, with the cenc scheme
  • HLS (hls/master.m3u8): #EXT-X-KEY:METHOD=SAMPLE-AES with the FairPlay key format com.apple.streamingkeydelivery

9. Play it with a DoveRunner license

Open Playground > DRM Tools > DRM playback tester in DoveRunner Lab. Choose Custom content, enter the DASH manifest URL of your output, paste a license token for the same content ID, and select Load custom content. In Chrome the video plays with Widevine, and the inspector shows the license request and key status.

Next steps

  • For DASH and HLS from a single output group, use a CMAF output group with AES-CBC (CBCS) encryption, which supports the most client environments.
  • For every field and option, see the AWS Elemental MediaConvert guide in DoveRunner Docs.