Create a job - User Guide MediaConvert

Step 1: Sign up for AWS

To use AWS Elemental MediaConvert, you need an AWS account. If you don't already have an account, you are prompted to create one when you sign up. You aren't charged for any AWS services that you sign up for unless you use them.

To sign up for AWS

1. Open https://portal.aws.amazon.com/billing/signup.

2. Follow the online instructions.

Part of the sign-up procedure involves receiving a phone call and entering a veriﬁcation code on the phone keypad.

Step 2: Create storage for ﬁles

AWS Elemental MediaConvert transcodes your input ﬁles to generate output ﬁles. MediaConvert can take in your input ﬁles from Amazon S3 or from a server through HTTP or HTTPS. For your output locations, MediaConvert works with Amazon S3 buckets.

Step 3: (Optional) Get set up to use DRM encryption

To create an Amazon S3 bucket

1. Sign in to the AWS Management Console and open the Amazon S3 console at https://

console.aws.amazon.com/s3/.

2. On the Amazon S3 console, choose Create bucket.

3. In the Create bucket dialog box, type a bucket name. If you want to create separate input and output buckets, give the bucket an appropriate name that will help you identify it later.

4. Choose a Region for your bucket. Make sure that you create your Amazon S3 buckets and do your MediaConvert transcoding in the same Region.

5. Choose Create.

6. If you want to create separate buckets for your input ﬁles and output ﬁles, repeat steps 2 through step 5.

Step 3: (Optional) Get set up to use DRM encryption

Protect your content from unauthorized use through encryption. Digital rights management (DRM) systems provide keys to AWS Elemental MediaConvert for content encryption, and licenses to supported players and other consumers for decryption.

To encrypt content, you must have a DRM solution provider.

• For an overview, see https://docs.aws.amazon.com/speke/latest/documentation/what-is-speke.html#services-architecture.

• To get set up, see https://docs.aws.amazon.com/speke/latest/documentation/customer-onboarding.html.

The only exception to this requirement is with the Apple HLS streaming protocol, where you can choose to deﬁne your own static keys or to use a DRM provider.

Step 4: Upload ﬁles for transcoding

AWS Elemental MediaConvert can take in your input ﬁles from Amazon S3 or from a server through HTTP or HTTPS. To provide your ﬁles from Amazon S3, upload them to your S3 bucket.

To upload ﬁles to an S3 bucket

1. In the Buckets pane, choose the name of your input bucket.

2. Choose Upload.

3. In the Upload dialog box, choose Add ﬁles, and then upload a media ﬁle that you want to transcode.

4. Choose Upload.

Note

For information about supported input ﬁles, see Supported input codecs and containers (p. 180).

HTTP input requirements

When your input ﬁle source is HTTP(S), you specify the URL rather than an Amazon S3 path.

Requirements for using HTTP(S) for input are as follows:

• All input ﬁles must be publicly readable.

• The HTTP(S) server must not require authentication.

• The HTTP(S) server must accept both HEAD and range GET requests.

• The URL that you specify can't include parameters.

If your HTTP(S) input uses redirection, it must follow these restrictions:

• You can redirect only once from the URL that you provide as your input. You can't redirect to a URL that, in turn, contains a redirect.

• The HTTP(S) status response code from the initial server must be either 301 or 302.

• The HTTP(S) response from the initial server must use its Location headers to provide the URL that it's redirecting MediaConvert to.

Step 5: Set up IAM permissions

To run transcoding jobs with AWS Elemental MediaConvert, you need an AWS Identity and Access Management (IAM) service role to allow MediaConvert access to your resources, such as your input ﬁles and the locations where your output ﬁles are stored.

Note

This service role is diﬀerent from an IAM role that might grant permissions to you as an IAM user. Instead, this role grants permissions to the MediaConvert service.

Regardless of how you initially create your IAM role, you can reﬁne this role at any time using IAM. For more information, see Adding and removing IAM identity permissions in the IAM User Guide.

You can create your IAM role in one of these ways:

• In the MediaConvert console, with full permissions. For instructions, see Creating a role in MediaConvert, full permissions (p. 6).

This is the fastest, easiest way to set up your role.

• In the MediaConvert console, with some restrictions on the permissions you grant. For instructions, see Creating a role in MediaConvert, conﬁgured (p. 6).

From the MediaConvert console, you can take the time to conﬁgure your role to allow MediaConvert access to only some of your Amazon S3 buckets and you can choose whether to grant invoke access to your API Gateway endpoints.

• In the IAM console. For instructions, see Creating a role in IAM (p. 7).

You can exercise ﬁne control over exactly what access you grant to MediaConvert when you set up your IAM role in the IAM console. You can also use IAM through the AWS CLI, API, or SDK.

Note

If you enable Amazon S3 default encryption on your Amazon S3 buckets, and you and specify your own master key managed by AWS Key Management Service, you must grant additional

Creating a role in MediaConvert, full permissions

permissions. For more information, see Granting permissions for MediaConvert to access encrypted S3 buckets (p. 7).

Setting up a default role

Regardless of how you create the IAM service role for MediaConvert to use, if you use the name MediaConvert_Default_Role, then the MediaConvert console uses it by default when you create jobs in the future.

Creating the IAM role in MediaConvert with full permissions

The easiest, fastest route to getting a job running with AWS Elemental MediaConvert is to set up the service role with full permissions to your Amazon Simple Storage Service (S3) buckets and your Amazon API Gateway endpoints. The MediaConvert service uses only the permissions that it needs to run your job.

Note

This approach doesn't follow the security best practice of least permissions.

To set up your MediaConvert role in MediaConvert, full permissions

1. Open the MediaConvert console at https://console.aws.amazon.com/mediaconvert.

2. Choose Get started.

3. On the Create job page, in the Job pane on the left, under Job settings, choose AWS integration.

4. In the Service access section, for Service role control, choose Create a new service role, full permissions.

5. For New role name, we suggest that you keep the default value MediaConvert_Default_Role.

When you do, MediaConvert uses this role by default for your future jobs.

6. Continue to the next step of this tutorial, Step 6: Create a job (p. 8).

Creating the IAM role in MediaConvert with conﬁgured permissions

This approach allows you to restrict the access that you grant MediaConvert to only speciﬁc S3 buckets, and to specify whether to alllow invoke access to your Amazon API Gateway endpoints.

To set up your MediaConvert role in MediaConvert, conﬁgured permissions

1. Open the MediaConvert console at https://console.aws.amazon.com/mediaconvert.

2. Choose Get started.

3. On the Create job page, in the Job pane on the left, under Job settings, choose AWS integration.

4. In the Service access section, for Service role control, choose Create a new service role, conﬁgure permissions.

5. For New role name, we suggest that you keep the default value MediaConvert_Default_Role.

When you do, MediaConvert uses this role by default for your future jobs.

6. For Input S3 locations and Output S3 locations, choose Add location. Select the S3 buckets that you created in the previous step of this tutorial, Step 2: Create storage for ﬁles (p. 3).

7. Optional. If you use features that require it, for API Gateway enpoint invocation, choose allow.

MediaConvert requires this access for the following features:

Creating a role in IAM

• Digital rights management with SPEKE

• Nielsen non-linear watermarking

If you prefer to allow MediaConvert invoke access only to a speciﬁc endpoint, you can modify these permissions in the role policy after you create it, using the AWS Identity and Access Management (IAM) service. For more information, see Editing IAM policies in the AWS Identity and Access Management User Guide.

Creating the IAM role in IAM

Working directly with IAM, you can do actions that aren't available in the MediaConvert console. You can either do this when you create your role in IAM, or you can create your role in MediaConvert and then use IAM to reﬁne it later.

The following procedure explains how to set up the role using the IAM console. For information about accessing IAM programmatically, see the appropriate document in the IAM documentation set.

To set up your MediaConvert role in IAM (console)

1. Sign in to the AWS Management Console and open the IAM console at https://

console.aws.amazon.com/iam/.

2. In the navigation pane of the IAM console, choose Roles, and then choose Create role.

3. Choose the AWS service role type, and then choose the MediaConvert service.

4. Choose the MediaConvert use case for your service. Then choose Next: Permissions. The service has already deﬁned the permissions used by the role. These permissions grant MediaConvert the following permissions:

• Full access to your Amazon S3 resources

• API Gateway invoke full access

The only entity that can assume this role is the MediaConvert service.

5. Choose Next: Review.

6. For Role name, enter a name that describes the purpose of the role. If you use the name

MediaConvert_Default_Role, then the MediaConvert console will use this role by default when you run jobs.

Role names must be unique within your AWS account. You can use up to 64 characters that are letters, numbers, or any of the following: + = , . @ - _

Because various entities might reference the role, you can't edit the name of the role after it has been created.

7. (Optional) For Role description, edit the description for the new service role.

8. Review the role, and then choose Create role.

Granting permissions for MediaConvert to access encrypted S3 buckets

When you enable Amazon S3 default encryption, Amazon S3 automatically encrypts your objects as you upload them. You can optionally choose to use AWS Key Management Service (KMS) to manage the master key. This is called SSE-KMS encryption.

Step 6: Create a job

If you enable SSE-KMS default encryption on the buckets that hold your AWS Elemental MediaConvert input or output ﬁles, you must add inline policies to your MediaConvert service role. Otherwise, MediaConvert can't read your input ﬁles or write your output ﬁles. Grant these permissions:

• If your input bucket has SSE-KMS default encryption, grant kms:Decrypt.

• If your output bucket has SSE-KMS default encryption, grant kms:GenerateDataKey.

The following example inline policy grants both permissions.

Example inline policy with kms:decrypt and kms:GenerateDataKey

This policy grants permissions for both kms:Decrypt and kms:GenerateDataKey.

{ "Version": "2012-10-17", "Statement": [

{

"Effect": "Allow", "Action": [

"kms:Decrypt", "kms:GenerateDataKey"

"Resource": "*", "Condition": { "StringLike":

{ "kms:ViaService": "s3.*amazonaws.com" } }

} ]}

Step 6: Create a job

A job does the work of transcoding. You specify the name of the ﬁle that you want to transcode (the input ﬁle), the name that you want MediaConvert to give the transcoded ﬁle, the preset that you want MediaConvert to use, and a few other settings. MediaConvert gets the input ﬁle from the Amazon S3 location that you specify in your job input settings, transcodes the ﬁle, and saves the transcoded ﬁle or ﬁles in the output location that you specify in the settings of the job output group.

To create a job

1. Open the MediaConvert console at https://console.aws.amazon.com/mediaconvert.

2. Choose Get started.

3. On the Create job page, provide transcode instructions and job settings. For more information, see Setting up a job in AWS Elemental MediaConvert (p. 10).

Make sure that you pick the same Region for your job and your ﬁle storage.

4. Choose Create.

For information about tracking the status of your job, see Using CloudWatch Events with AWS Elemental MediaConvert (p. 223).

Step 6: Create a job

For information about the ﬁle names and paths for your job outputs, see Output ﬁle names and paths (p. 228).

5. If you don't want to keep the transcoded ﬁles that you generate during this tutorial, delete them from Amazon S3 to avoid incurring storage charges.

Optional: Pause your queues

Setting up a job in AWS Elemental MediaConvert

An AWS Elemental MediaConvert job does the work of transcoding a media ﬁle into packages and ﬁles in various formats and in diﬀerent sizes for distribution to end viewers. When you create a job, you specify the information that the service requires to perform the transcoding: which ﬁle to transcode, which types of ﬁles to create and where to store them, which encoding settings to use, which advanced features to apply, and so on.

To set up a job, you deﬁne input ﬁles for the service to transcode, and you specify the source for each video, audio, and captions media element. That source might be a speciﬁc part of the primary input ﬁle, or it might be a separate ﬁle. Next, you specify the types of output ﬁles and packages that you want AWS Elemental MediaConvert to generate from the input. You also specify the detailed encoding settings to produce the quality and type of output that you want. The following illustration shows these pieces of a job that you set up.

To set up your job, complete the procedures in the following topics.

Topics

• Optional: Pause your queues (p. 10)

• Step 1: Specify your input ﬁles (p. 11)

• Step 2: Create input selectors for video, audio, and captions (p. 12)

• Step 3: Create output groups (p. 14)

• Step 4: Create outputs (p. 15)

• Step 5: Specify global job settings (p. 21)

• Using variables in your job settings (p. 21)

Optional: Pause your queues

If you are just getting started with AWS Elemental MediaConvert or are experimenting with the MediaConvert console, you might want to pause your queues to avoid accidentally starting a job before you're ready. For more information about queues, see Working with queues (p. 64).

To pause or reactivate an on-demand queue

1. Open the MediaConvert console at https://console.aws.amazon.com/mediaconvert.

在文檔中 User Guide MediaConvert (頁 11-19)