# Using Kantar for audio watermarking
<a name="kantar-watermarking"></a>

Kantar is a company that provides and tracks unique identifiers for media content in the form of audio watermarks that are audible to machines but not to humans. After you establish a relationship with Kantar, you can use AWS Elemental MediaConvert to encode these watermarks into your content, for audience measurement and anti-piracy applications.

To use MediaConvert to encode Kantar watermarks, you use AWS Secrets Manager to store your Kantar credentials. These credentials are the username and password that you set up with Kantar. Then you grant the MediaConvert service permission to read those credentials, so that MediaConvert can communicate with the Kantar servers to request your watermarks and to provide log information. In your MediaConvert job, you provide your Kantar license information and information about the media asset that you're encoding. For more information about these steps, see the following topics.

**Topics**
+ [Getting a Kantar watermarking license](getting-a-kantar-watermarking-license.md)
+ [Storing your Kantar credentials in AWS Secrets Manager](storing-your-kantar-credentials-in-secrets-manager.md)
+ [Granting IAM permissions to your Kantar credentials](granting-permissions-for-mediaconvert-to-access-secrets-manager-secret.md)
+ [Configuring a job for Kantar watermarking](setting-up-your-job-for-kantar-watermarking.md)
+ [Kantar job requirements](kantar-requirements.md)

# Getting a Kantar watermarking license
<a name="getting-a-kantar-watermarking-license"></a>

To use Kantar audio watermarking with MediaConvert, you must first establish a relationship with Kantar and acquire a license from them. Kantar provides the following guidance for doing so.

In order to get a watermarking embedding license, contact [Kantar Media support](https://kantarmedia.atlassian.net/wiki/spaces/WS/overview) with following information:
+ Product name and version
+ Customer name
+ Country
+ If different, country of broadcast
+ Channel(s) to be watermarked
+ Customer internal name for the hardware platform
+ AuthorisationCode for each piece od hardware, or login contact for the online solution

# Storing your Kantar credentials in AWS Secrets Manager
<a name="storing-your-kantar-credentials-in-secrets-manager"></a>

After you establish a relationship with Kantar, store your Kantar username and password in an AWS Secrets Manager secret. You can find a step-by-step tutorial in the topic [Create and store your secret in AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html#tutorial-basic-step1) in the *AWS Secrets Manager User Guide.*

**To store your Kantar credentials in a Secrets Manager secret**

Follow the tutorial linked in the introduction to this procedure, with the following differences.

1. Make sure that you use the same AWS Region for Secrets Manager that you use for your MediaConvert job.

1. In the **Specify key/value pairs to be stored in the secret** section, set up two key-value pairs. One holds your Kantar login name and the other holds your password.  
![\[This screenshot shows two key-value pairs. The key for the first is "login" and the value is your Kantar login name. The key for the second is "password" and the value is your Kantar password.\]](http://docs.aws.amazon.com/mediaconvert/latest/ug/images/kantar-secret-ASM.png)

   1. Type **login** in the left field and then type your Kantar login name in the right field.

   1. Choose **Add row** to bring up a second pair of entry fields.

   1. Type **password** in the left field and then type your Kantar password in the right field.

   The plaintext version of your secret should look like this: `{ "login": "KantarLogin", "password": "KantarPassword" }`, where KantarLogin is the username for your Kantar credentials and KantarPassword is the password for your Kantar credentials.

1. In the **Secret name and description** section, for **Secret name**, use a name that you will associate with Kantar, such as **KantarCreds**.
**Note**  
You provide the name of this secret in your MediaConvert job settings.

1. For **Description**, you might want to note that this is the secret that you use with MediaConvert for encoding your Kantar watermarks.

1. After you store the secret, copy the ARN of your secret to use when you grant IAM permissions to MediaConvert to access the secret.

   1. On the Secrets Manager **Secrets** page, choose the name of your secret.

   1. Copy and save the string you see listed under **Secret ARN**.
**Note**  
You use this ARN when you grant MediaConvert permissions to get this secret.

# Granting IAM permissions to your Kantar credentials
<a name="granting-permissions-for-mediaconvert-to-access-secrets-manager-secret"></a>

When you use AWS Elemental MediaConvert, you specify an IAM service role that grants permissions to the service to access the resources it needs to run your job. For example, your MediaConvert service role grants MediaConvert permissions to read your job input files from Amazon S3. For information about setting up that service role, see [Setting up IAM permissions](iam-role.md).

To encode Kantar watermarks, add permissions to this service role to grant MediaConvert access to read the AWS Secrets Manager secret that holds your Kantar credentials.

**To grant MediaConvert permission to read your Kantar credentials**

1. Create a policy that grants permission to read your Secrets Manager secret.

   1. Make sure that you have the ARN to the Secrets Manager secret that you created in the previous topic.

   1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).

   1. In the navigation pane on the left, under **Access management**, choose **Policies**.

   1. Choose **Create policy**.

   1. On the **Create policy** page, next to **Service**, choose **Choose a service**.

   1. In the search field, type **secrets** and then choose **Secrets Manager** from the results.

   1. In the **Filter actions** search field, type **GetSecretValue** and then choose **GetSecretValue** from the results.

   1. In the **Resources** section, next to **Secret**, choose **Add ARN**.

   1. On the **Add ARN(s)** page, next to **Specify ARN for Secret**, choose **List ARNs manually**.

   1. In the **Type or paste a list of ARNs** section, paste the ARN for your Kantar credentials secret that you copied at the end of the procedure in the previous topic.

   1. Choose **Add**.

   1. At the bottom of the **Create policy** page, choose **Next: Tags**.

   1. Choose **Next: Review**.

   1. Under **Review policy**, for **Name** type a name that will help you remember the purpose of this policy, such as **GetKantarCreds**.

   1. Optionally, for **Description**, jot a note to yourself for later. For example, you might write "This provides MediaConvert permission to read my Kantar credentials."

   1. Choose **Create policy**.

1. Attach the policy to your MediaConvert role.

   1. In the navigation pane on the left, under **Access management**, choose **Roles**.

   1. From the list of roles, choose the name of the role that you use with your MediaConvert job. This role is often **MediaConvert\$1Default\$1Role**.

   1. On the role **Summary** page, on the **Permissions** tab, choose **Attach policies**.

   1. In the search field, type the name of the policy you created, such as **GetKantarCreds**.

   1. In the results list, choose the check box next to the policy name.

   1. Choose **Attach policy**.

   1. On the **Summary** page for the role, review the list of policies and confirm that your policy that grants permission to get your Kantar credentials appears there.

# Configuring a job for Kantar watermarking
<a name="setting-up-your-job-for-kantar-watermarking"></a>

After you've established your relationship with Kantar, stored your Kantar credentials in AWS Secrets Manager, and granted permission to AWS Elemental MediaConvert to get these credentials, set up your MediaConvert job to encode the Kantar watermarks.

**To set up your job to encode Kantar watermarks**

1. Set up your job as usual. For more information, see [Tutorial: Configuring job settings](setting-up-a-job.md).

1. On the **Create job** page, in the **Job** pane on the left, under **Job settings**, choose **Partner integrations**.

1. Enable **Kantar SNAP file watermarking**.

1. Provide values for the Kantar settings.

   1. For **Credentials secret name**, type the name of the Secrets Manager secret that you created to store your Kantar credentials. For example, **KantarCreds**.

   1. For **Kantar license ID**, type the license ID that Kantar provides you.

   1. For **Channel name**, type one of the channel names that are listed in your Kantar audio license.

   1. For **Content reference**, type the unique identifier that Kantar uses for the asset that you're encoding.

1. Confirm that the service role you've specified in the job is the same one that you, in the previous topic, attached permissions to that grant access to your Kantar credentials. If that role Is MediaConvert\$1Default\$1Role, you don't need to choose it explicitly, because MediaConvert will use that role by default. To specify the role if it has a different name, do the following:

   1. In the **Job** pane on the left, choose **AWS integration**.

   1. In the **Service access** section, find **Service role**. Confirm that the specified role is the one with the correct permissions.

# Kantar job requirements
<a name="kantar-requirements"></a>

When you set up your job, note these restrictions on your other settings.
+ You can't use Kantar watermarking and Nielsen watermarking in the same job.
+ Your output audio sample rate must be 48 kHz or greater.