AWS Elemental MediaPackage
An origin service that converts and delivers live video streams in multiple device-specific formats, with support for DRM protection and time-shifted playback
Overview
AWS Elemental MediaPackage is an origin service for securely delivering live and on-demand video content in formats optimized for viewing devices. It simultaneously converts incoming live streams into multiple formats including HLS, DASH, CMAF, and MSS, delivering in formats optimized for each device (smartphones, smart TVs, game consoles, etc.). For DRM (Digital Rights Management), it supports Apple FairPlay, Google Widevine, and Microsoft PlayReady to prevent unauthorized content copying. Time-shifted playback, catch-up TV, and DVR functionality are provided as standard, meeting the requirements of broadcasters and streaming services.
Channel and Endpoint Design Patterns
MediaPackage's basic structure is a two-layer architecture of channels that accept input and endpoints that deliver to viewers. A channel accepts HLS or CMAF input from MediaLive or other encoders, with two input URLs auto-generated for redundancy. Endpoints are created attached to channels and configured individually per output format. For example, a common design creates an HLS endpoint for iOS, a DASH endpoint for Android, and a CMAF endpoint for all-device compatibility simultaneously. Each endpoint allows individual adjustment of segment duration (typically 6 seconds), manifest window length (typically 60 seconds), and buffer length. Shorter segments reduce latency but decrease CDN cache efficiency - a tradeoff. For low-latency delivery required in sports broadcasts, 2-second segments combined with CMAF is effective.
DRM Protection and Access Control Implementation
MediaPackage's DRM integration is achieved by combining MediaPackage encryption settings with an external key server (SPEKE-compatible). The SPEKE (Secure Packager and Encoder Key Exchange) protocol delegates encryption key generation and management to external DRM providers (BuyDRM, EZDRM, PallyCon, etc.). For multi-DRM support, three licenses - FairPlay (Apple devices), Widevine (Android/Chrome), and PlayReady (Windows/Xbox) - are simultaneously applied to a single piece of content, with the appropriate DRM automatically selected per device. For access control, combining CDN authentication (CloudFront signed URLs) with IP address restrictions builds a multi-layered defense ensuring only legitimate viewers can access streams. Content key rotation intervals are also configurable, maintaining security even during long-duration live broadcasts.
Time-Shifted Playback and VOD Harvesting Operations
MediaPackage's time-shift feature retains up to 72 hours of past live stream content, allowing viewers to start playback from any point in time. It is used for broadcaster catch-up TV (missed program viewing) and sports broadcast rewind playback. The startover parameter enables playback from the program's start time, providing a complete viewing experience even for viewers who tuned in mid-stream. The VOD harvesting feature extracts specified segments from a live stream and saves them to S3 as VOD assets. This enables operations that automatically generate highlight clips after live delivery ends and repurpose them for on-demand distribution. On the cost side, storage costs increase with time-shift window length, so analyzing viewing patterns to set optimal window lengths is important. When combining with CloudFront, enabling Origin Shield to reduce request volume to the origin is a recommended design that optimizes MediaPackage processing load and costs.