Live Multi-DRM packaging with AWS Elemental MediaLive and MediaPackage

What you will build

If you stream live on AWS, you can add DoveRunner Multi-DRM without changing your encoder. In this lesson, a video file loops through AWS Elemental MediaLive, standing in for a live feed. MediaLive sends it to AWS Elemental MediaPackage (v2), which encrypts the stream as it arrives. For the keys, MediaPackage asks the DoveRunner key server using the SPEKE v2 protocol. It publishes two endpoints: DASH for PlayReady and Widevine, and HLS for FairPlay. Your players get licenses from DoveRunner.

You can watch the stream this run produced in Playground > Multi-DRM live stream demo.

Before you start

• AWS account with access to IAM, MediaLive, and MediaPackage
• DoveRunner Console account (console.doverunner.com) for your KMS token, with the key rotation right turned on. If it is not on yet, ask DoveRunner support
• A content ID (CID) of your choice. You enter it as the Resource ID in MediaPackage and use the same CID in your license tokens
• A source video in S3 (this lesson uses Big Buck Bunny)

1. Get the KMS token

In DoveRunner Console, go to Multi DRM > Settings and select Retrieve Secret Information. Your KMS token appears in the KMS Token row. Treat it like a password: it goes only into the key server URL in MediaPackage.

MediaPackage v2 uses the SPEKE v2 key server URL, for both CENC and CBCS endpoints:

https://drm-kms.doverunner.com/v2/cpix/getKey?enc-token=<KMS token>

2. Create the IAM role

MediaPackage needs a role to call the key server. In IAM, create a role with a custom trust policy that lets the MediaPackage service principals assume it. For MediaPackage v2, include both mediapackage.amazonaws.com and mediapackagev2.amazonaws.com; without the v2 principal, endpoint creation fails with "unable to assume the IAM role". Attach AmazonAPIGatewayInvokeFullAccess and name the role SPEKEAccess.

3. Create the MediaPackage channel

Open MediaPackage and go to Live v2. Create a channel group, then a channel inside it, with the input type CMAF. MediaLive pushes its output to this channel. You don't need a channel policy when MediaLive runs in the same account.

4. DASH endpoint (PlayReady + Widevine, multi-key)

Add an origin endpoint with CMAF as the container and turn on Encrypt content:

• Encryption method: CENC, with PlayReady and Widevine
• Resource ID: your CID
• Key server URL: the SPEKE v2 URL from step 1
• Role ARN: SPEKEAccess
• SPEKE version: 2.0
• Video preset: 2 (multi-key: SD and HD video get separate keys)
• Audio: unencrypted in this lesson

Add a DASH manifest.

5. Key rotation

Under Additional configuration, set the Key rotation interval. MediaPackage v2 accepts 300 seconds or more, so this lesson uses 300. Then add &key-rotation=true to the key server URL. The two must match, or playback can fail. The license token also needs key rotation turned on. Each rotation means a new license for every viewer, so plan for that on large live events.

6. HLS endpoint (FairPlay)

Add a second endpoint for Safari: CMAF again, with the CBCS method and FairPlay added. Use the same Resource ID, key server URL, and role. Set the video preset to 1 so the video uses a single key, which keeps the Safari test simple. Add an HLS manifest, and leave the public access policy on so players can reach both endpoints.

7. MediaLive input

In MediaLive, create an input of type MP4 with the S3 location of your video. A real live stream uses RTMP, SRT, or another live input instead. When you attach the input to the channel, set Source end behavior to Loop.

8. MediaLive channel and output

1. Create a single-pipeline channel to keep costs low. For the IAM role, use MediaLiveAccessRole, which the console can create for you. The channel can't start until a role is set.
2. Attach the input and add an audio selector.
3. Add an output group of type CMAF Ingest (not "MediaPackage", which is for v1) and paste the ingest URL of your MediaPackage channel as the destination.
4. Add the outputs: 720p video, 360p video, and audio. In CMAF Ingest each output carries one track type only, so audio needs its own output.

MediaLive does not encrypt anything here. MediaPackage does.

9. Start the channel

Create the channel and select Start. After about a minute the state changes to Running: the video now loops as a live stream and MediaPackage encrypts it.

10. Verify the output

• DASH: ContentProtection for Widevine and PlayReady with the cenc scheme, and one KID per video track
• HLS: a FairPlay key entry (skd://). Each rotation adds a new one, so you see more over time

The playlists point to keys, never contain the keys themselves.

11. Play it with a DoveRunner license

Open Playground > DRM playback tester in DoveRunner Lab and choose Custom content. Paste the DASH manifest URL for Chrome or Edge, or the HLS manifest URL for Safari. In License policy & token tools, build a token for your CID with key rotation turned on and a policy for the SD and HD tracks. Paste the token, load the stream, and press play. The Token tab shows key rotation on, and the Timeline shows a new license request after each rotation.

Stop the MediaLive channel when you're done: it bills while it runs.

Next steps

• For every field and option, see the AWS Elemental MediaPackage guide in DoveRunner Docs.
• For file-based (VOD) packaging on AWS, see the MediaConvert lesson in this course.