Configure AWS MediaPackage live channel with SPEKE encryption and HLS/DASH endpoints
domain: aws-mediapackage · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Create a MediaPackage channel, copy the ingest endpoints, and configure your upstream encoder (MediaLive or on-premises) to push two redundant RTMP or HLS ingest streams
Create an HLS endpoint and a DASH endpoint on the channel; for each, open the Encryption section and enter your SPEKE key provider URL, role ARN, and system IDs for the desired DRM systems
Set the segment duration and manifest window length appropriate for your latency target; for low-latency use, enable low-latency HLS (LL-HLS) on the endpoint
Attach a CloudFront distribution in front of the MediaPackage endpoints and restrict origin access so segments are only served through CloudFront
Test playback with Shaka Player (Widevine/PlayReady) and hls.js or Safari (FairPlay) to verify DRM handshakes succeed end-to-end
Known gotchas
The SPEKE key provider URL must be reachable from MediaPackage's AWS service role — if it is behind a VPC, use an API Gateway endpoint with a resource policy, not a private IP
MediaPackage v1 and MediaPackage v2 have different API shapes and console flows; new deployments should use v2, which has a different ARN format and endpoint resource model
Setting the manifest window shorter than the DVR buffer window causes viewers who pause to lose their position; set manifest window >= the intended DVR window
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?