AWS Elemental MediaPackage
An origin service that converts and delivers live video streams in multiple device-specific formats, with support for DRM protection and time-shifted playback
Overview
AWS Elemental MediaPackage is an origin service for securely delivering live and on-demand video content in formats optimized for viewing devices. It simultaneously converts incoming live streams into multiple formats including HLS, DASH, CMAF, and MSS, delivering in formats optimized for each device (smartphones, smart TVs, game consoles, etc.). For DRM (Digital Rights Management), it supports Apple FairPlay, Google Widevine, and Microsoft PlayReady to prevent unauthorized content copying. Time-shifted playback, catch-up TV, and DVR functionality are provided as standard, meeting the requirements of broadcasters and streaming services.
Channel and Endpoint Design Patterns
MediaPackage's basic structure is a two-layer architecture of channels that accept input and endpoints that deliver to viewers. A channel accepts HLS or CMAF input from MediaLive or other encoders, with two input URLs auto-generated for redundancy. Endpoints are created attached to channels and configured individually per output format. For example, you can create an HLS endpoint for iOS, a DASH endpoint for Android, and a CMAF endpoint on the same channel at the same time. Each endpoint allows individual adjustment of segment duration, manifest window length, and buffer length. Shorter segments reduce latency but decrease CDN cache efficiency - a tradeoff.
DRM Protection and Access Control Implementation
MediaPackage's DRM integration is achieved by combining MediaPackage encryption settings with an external key server (SPEKE-compatible). The SPEKE (Secure Packager and Encoder Key Exchange) protocol delegates encryption key generation and management to external DRM providers (BuyDRM, EZDRM, PallyCon, etc.). For multi-DRM support, FairPlay (Apple devices), Widevine (Android/Chrome), and PlayReady (Windows/Xbox) can be applied to CMAF content. For access control, CDN authorization (MediaPackage checks a custom HTTP header added by the CDN against a value stored in Secrets Manager) can be combined with an IP allowlist so that playback requests that do not come through the CDN are not fulfilled. Content key rotation intervals are also configurable, maintaining security even during long-duration live broadcasts.
Time-Shifted Playback and VOD Harvesting Operations
MediaPackage's time-shift feature lets viewers start playback from any point within the range set on the endpoint (the startover window), for live content up to 14 days old (as of October 2026). It is used for broadcaster catch-up TV (missed program viewing) and sports broadcast rewind playback. Adding start and end parameters to the playback request enables playback from the program's start time, so viewers who tuned in mid-stream can watch from the beginning. The VOD harvesting feature extracts specified segments from a live stream and saves them to S3 as VOD assets. This enables operations that extract highlight clips after a live event and repurpose them for on-demand distribution. When combining with CloudFront, enabling Origin Shield consolidates requests to the origin and can reduce the load on MediaPackage.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon CloudFront official page
- Amazon S3 official page
- AWS Lambda official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.