# Sharing content in your AWS Elemental MediaConnect flow with other AWS accounts Sharing content with other AWS accounts You can grant an entitlement to share the content in your AWS Elemental MediaConnect flow with another AWS account (subscriber account). When the subscriber sets up a flow based on the entitlement, the service generates an output on your flow to represent the stream from your flow to the subscriber's flow. This output is counted as part of the 50 maximum outputs that you can have on your flow. You can grant, update, and revoke entitlements at any time, even on an active flow. If you want to stop streaming content to the subscriber’s flow on a temporary basis, you can disable the entitlement. Later, you can enable the entitlement when you're ready to allow content to stream to the subscriber's flow again. You can also specify the percentage of the entitlement data transfer fee that you want the subscriber to be responsible for. **Note** If you grant an entitlement and later [disable](entitlements-disable.md) it (to temporarily stop streaming content to the subscriber’s flow), the entitlement remains associated with your flow and counts toward your maximum number of entitlements. However, if you [revoke](entitlements-revoke.md) the entitlement (to permanently stop streaming content to the subscriber’s flow), the entitlement is removed from your flow and no longer counts toward the maximum number of entitlements. After you grant an entitlement, you provide information about the entitlement (name, AWS Region, and encryption details) to the subscriber. The subscriber uses this information to create a MediaConnect flow that uses your flow as the source. The subscriber's flow must be in the same AWS Region as your flow. If the subscriber wants a flow in a different Region, they must create a second flow in the new Region. The following illustration shows this process. ![\[This illustration shows the setup for sharing content across AWS Regions.\]](http://docs.aws.amazon.com/mediaconnect/latest/ug/images/entitlement-different-regions.png) **Note** MediaConnect doesn't support entitlements on CDI flows. You can only grant entitlements on transport stream flows, with the exception of TR-07 sources. **Topics** + [ # Granting an entitlement on a flow ](entitlements-grant.md) + [ # Updating an entitlement ](entitlements-update.md) + [ # Managing tags on an entitlement ](entitlements-manage-tags.md) + [ # Revoking an entitlement ](entitlements-revoke.md) + [ # Disabling an entitlement temporarily ](entitlements-disable.md) + [ # Enabling an entitlement that has been temporarily disabled ](entitlements-enable.md) # Granting an entitlement on a flow Granting an entitlementSharing the entitlement data transfer fee with the subscriber When you grant an entitlement, you can now specify the percentage of the entitlement data transfer fee that you want the subscriber to be responsible for. You can grant an entitlement to an existing flow to share your content with another AWS account (the subscriber account). The subscriber creates an AWS Elemental MediaConnect flow in the same AWS Region, using your flow as the source. When this happens, the service generates an output on your flow to represent the video stream from your flow to the subscriber's flow. The subscriber can use an entitlement only once. **Prerequisites** Before you can grant an entitlement, you must do the following: + Obtain the subscriber's AWS account number. + If you want to encrypt the video as it is sent from your flow to the subscriber's flow, set up encryption using [static key encryption](encryption-static-key-set-up.md) or [Secure Packager and Encoder Key Exchange (SPEKE)](encryption-speke-set-up.md). **To grant an entitlement on a flow (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that you want to grant an entitlement on. The details page for that flow appears. 1. Choose the **Entitlements** tab. 1. Choose **Grant entitlement**. The **Grant entitlement** page appears. 1. For **Name**, specify a name for the entitlement that will help you and the subscriber differentiate this flow from other flows. The name also becomes part of the entitlement ARN, which is visible to the subscriber. 1. For **Subscriber account ID**, specify the subscriber's 12-digit AWS account ID. Don't include hyphens in the ID. 1. For **Description**, specify a description that will help you identify this entitlement later. The description is visible only on the MediaConnect console for your account. 1. For **Data transfer subscriber fee percent**, specify the percentage of the entitlement data transfer fee that you want the subscriber to be responsible for. AWS bills your account for the remainder. For example, if you specify **15**, AWS bills the subscriber's account for 15% of the entitlement data transfer fee and your account for the remaining 85%. **Note** Even if you specify that the subscriber is responsible for a portion or all of the entitlement data transfer fee, the subscriber will not incur fees until they create and start a flow that is based on this entitlement. 1. For **Entitlement status**, specify whether you want the entitlement enabled or disabled. If the entitlement is enabled, the subscriber can create a flow based on the entitlement and start streaming content right away. If the entitlement is disabled, the subscriber must wait for you to enable it before content can stream from your flow to their flow. 1. If you want to encrypt the video as it is sent from your flow to the subscriber's flow, choose one of the following tabs: ------ #### [ Static key encryption ] 1. In the **Encryption** section, choose **Enable**. 1. For **Encryption type**, choose **Static key**. 1. For **Role ARN**, specify the ARN of the role that you created when you [set up encryption](encryption-static-key-set-up.md#encryption-static-key-set-up-create-iam-role). 1. For **Secret ARN**, specify the ARN that AWS Secrets Manager assigned when you [created the secret to store the encryption key](encryption-static-key-set-up.md#encryption-static-key-set-up-store-key). 1. For **Encryption algorithm**, choose the type of encryption that you want to use to encrypt the source. ------ #### [ SPEKE encryption ] 1. In the **Encryption** section, choose **Enable**. 1. For **Encryption type**, choose **SPEKE**. 1. For **Encryption algorithm**, choose the type of encryption that you want to use to encrypt the source. 1. For **Role ARN**, enter the Amazon Resource Name (ARN) of the IAM role that provides you access to send your requests through API Gateway. You created this role when you [set up encryption](encryption-speke-set-up.md#encryption-speke-set-up-create-iam-role). The following example shows a role ARN: ``` arn:aws:iam::111122223333:role/SpekeAccess ``` 1. For **Resource ID**, enter an identifier for the content. The service sends this to the key server to identify the current endpoint. How unique you make this depends on how fine-grained you want access controls to be. The resource ID is also known as the content ID. The following example shows a resource ID: ``` MovieNight20171126093045 ``` 1. For **Device ID**, enter the value of one of the devices that you configured with your conditional access (CA) platform key provider. 1. For **URL**, enter the URL of the API Gateway proxy that you set up to talk to your key server. The API Gateway proxy must reside in the same AWS Region as MediaConnect. The following example shows a URL. ``` https://1wm2dx1f33.execute-api.us-west-2.amazonaws.com/SpekeSample/copyProtection ``` 1. (Optional) For **Constant initialization vector** enter a 128-bit, 16-byte hex value represented by a 32-character string, to be used with the key for encrypting content. ------ 1. At the bottom of the page, choose **Grant entitlement**. 1. On the **Entitlements** tab, locate the new entitlement in the list. 1. Make a note of the entitlement ARN. 1. Provide the following information to the subscriber: + The entitlement ARN + The AWS Region that you created the flow in + The encryption key and algorithm if you set up encryption on the entitlement + The percentage of the entitlement data transfer fee that the subscriber is responsible for **Note** MediaConnect suppresses null packets in an effort to optimize the data connection between the content originator's flow and the subscriber's flow. This can result in a fluctuating bitrate on the subscriber's flow, or a difference between the bitrate of the content originator's flow and the subscriber’s flow. We recommend that you monitor source health as a combination of `SourceBitRate` and other metrics such as `SourceContinuityCounter` and `SourceNotRecoveredPackets`. **To grant an entitlement on a flow (AWS CLI)** 1. Create a JSON file that contains the details of the entitlements that you want to grant. The following example shows the structure for the contents of the file: ``` [ { "Description": "For AnyCompany", "Encryption": [ { "Algorithm": "aes128", "KeyType": "static-key", "RoleArn": "arn:aws:iam::111122223333:role/MediaConnect-ASM", "SecretArn": "arn:aws:secretsmanager:us-west-2:111122223333:secret:mySecret1" } ], "Name": "AnyCompany_Entitlement", "Subscribers": [ "444455556666", "123456789012" ] }, { "Description": "For Example Corp", "Name": "ExampleCorp", "Subscribers": [ "777788889999" ] } ] ``` 1. In the AWS CLI, use the `grant-flow-entitlements` command: ``` aws mediaconnect grant-flow-entitlements --entitlements --flow-arn arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame --cli-input-json file://entitlements.json ``` The following example shows the return value: ``` { "Entitlements": [ { "Name": "AnyCompany_Entitlement", "EntitlementArn": "arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11aa22bb11aa22bb-3333cccc4444:AnyCompany_Entitlement", "Subscribers": [ "444455556666", "123456789012" ], "Description": "For AnyCompany", "Encryption": { "SecretArn": "arn:aws:secretsmanager:us-west-2:111122223333:secret:mySecret1", "Algorithm": "aes128", "RoleArn": "arn:aws:iam::111122223333:role/MediaConnect-ASM", "KeyType": "static-key" } }, { "Name": "ExampleCorp", "EntitlementArn": "arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-3333cccc4444dddd-1111aaaa2222:ExampleCorp", "Subscribers": [ "777788889999" ], "Description": "For Example Corp" } ], "FlowArn": "arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame" } ``` # Updating an entitlement After an entitlement has been created, you can still update the description, status, and subscribers. If you change the subscriber account ID, the content becomes unavailable to the original subscriber account. If the original subscriber already created a flow that used the entitlement as a source, the associated output is removed from your flow. **To update an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to update. The details page for that flow appears. 1. Choose the **Entitlements** tab. 1. Choose the entitlement that you want to update. 1. Choose **Update**. 1. Make the appropriate changes, and then choose **Save**. **To update an entitlement on a flow (AWS CLI)** + In the AWS CLI, use the `update-flow-entitlement` command: ``` aws mediaconnect update-flow-entitlement --flow-arn arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame --entitlement-arn arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11aa22bb11aa22bb-3333cccc4444:AnyCompany_Entitlement --description 'For AnyCompany Affiliate' --subscribers 444455556666", "123456789012 ``` The following example shows the return value: ``` { "FlowArn": "arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame", "Entitlement": { "Name": "AnyCompany_Entitlement", "Description": "For AnyCompany Affiliate", "EntitlementArn": "arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11aa22bb11aa22bb-3333cccc4444:AnyCompany_Entitlement", "Encryption": { "KeyType": "static-key", "Algorithm": "aes128", "RoleArn": "arn:aws:iam::111122223333:role/MediaConnect-ASM", "SecretArn": "arn:aws:secretsmanager:us-west-2:111122223333:secret:mySecret1" }, "Subscribers": [ "444455556666", "123456789012" ] } } ``` # Managing tags on an entitlement You can use tags to help you track the billing and organization for your AWS Elemental MediaConnect flows, sources, outputs, and entitlements. These are the same tags that AWS Billing and Cost Management provides for organizing your AWS bill. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*. **Topics** + [ # Adding tags on a MediaConnect entitlement ](entitlements-manage-tags-add.md) + [ # Editing tags on a MediaConnect entitlement ](entitlements-manage-tags-edit.md) + [ # Removing tags from a MediaConnect entitlement ](entitlements-manage-tags-remove.md) # Adding tags on a MediaConnect entitlement Adding tags on a entitlement Use tags to help you track the billing and organization for your AWS Elemental MediaConnect entitlements. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*. **To add tags to an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to add tags to. 1. Choose the **Entitlements** tab. A list of entitlements for that flow appears. 1. Choose the entitlement that you want to add tags to. 1. Choose **Manage tags**. 1. Choose **Manage tags**, and then choose **Add tag**. 1. For each tag that you want to add, do the following: 1. Enter a key and a value. For example, your key can be **sports** and your value can be **golf**. 1. Choose **Add tag**. 1. Choose **Update**. # Editing tags on a MediaConnect entitlement Editing tags on a entitlement Use tags to help you track the billing and organization for your AWS Elemental MediaConnect entitlements. For more information about using tags for cost allocation, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation.html) in the *AWS Billing User Guide*. **To edit tags on an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to edit tags for. 1. Choose the **Entitlements** tab. A list of entitlements for that flow appears. 1. Choose the entitlement that you want to edit tags for. 1. In the **Details** section, choose **Manage tags**. 1. Choose **Manage tags**. 1. Update the tags, as needed. 1. Choose **Update**. # Removing tags from a MediaConnect entitlement Removing tags from a entitlement You can remove a tag from a entitlement if you no longer want to use it to track the billing and organization for it. **To remove tags from an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to remove tags from. 1. Choose the **Entitlements** tab. A list of entitlements for that flow appears. 1. Choose the entitlement that you want to remove tags from. 1. In the **Details** section, choose **Manage tags**. 1. Choose **Manage tags**. 1. Choose **Remove tag** next to each tag that you want to delete. 1. Choose **Update**. # Revoking an entitlement After you revoke an entitlement, the content becomes unavailable to the subscriber account permanently. The entitlement and the associated output are removed from your flow. If you revoke an entitlement and later decide you need to grant that entitlement again, the subscriber's flow must be manually restarted. The subscriber's flow will not start automatically after the entitlement has been granted. If you want to stop streaming content to the subscriber’s flow temporarily, [disable](entitlements-disable.md) the entitlement instead. **To revoke an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to revoke. The details page for that flow appears. 1. Choose the **Entitlements** tab. 1. Choose the entitlement that you want to revoke. 1. Choose **Revoke**. **To revoke an entitlement on a flow (AWS CLI)** + In the AWS CLI, use the `revoke-flow-entitlement` command: ``` aws mediaconnect revoke-flow-entitlement --flow-arn arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame --entitlement-arn arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11aa22bb11aa22bb-3333cccc4444:AnyCompany_Entitlement ``` The following example shows the return value: ``` { "FlowArn": "arn:aws:mediaconnect:us-east-1:111122223333:flow:1-23aBC45dEF67hiJ8-12AbC34DE5fG:BaseballGame", "EntitlementArn": "arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11aa22bb11aa22bb-3333cccc4444:AnyCompany_Entitlement" } ``` # Disabling an entitlement temporarily Disabling an entitlementDisabling entitlements You can now disable an entitlement to temporarily stop streaming content to the subscriber’s flow. When you're ready to reinstate access, you can enable the entitlement. When you disable an entitlement, the content becomes unavailable to the subscriber account immediately. However, the entitlement and the associated output remain on your flow. These resources continue to count toward your quota for outputs and entitlements. Later, you can [enable the entitlement](entitlements-enable.md) to re-instate access. If you want to stop streaming content to the subscriber’s flow permanently, [revoke](entitlements-revoke.md) the entitlement instead. That action removes the entitlement and the associated output from your flow. **To disable an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to disable. The details page for that flow appears. 1. Choose the **Entitlements** tab. 1. Choose the entitlement that you want to disable. 1. Choose **Disable**. # Enabling an entitlement that has been temporarily disabled Enabling an entitlement If an entitlement has been [disabled](entitlements-disable.md), you can enable it to start streaming content to the subscriber’s flow again. **Note** If the entitlement was [revoked](entitlements-revoke.md), you can't enable it. You must [grant](entitlements-grant.md) a new entitlement. **To enable an entitlement (console)** 1. Open the MediaConnect console at [https://console.aws.amazon.com/mediaconnect/](https://console.aws.amazon.com/mediaconnect/). 1. On the **Flows** page, choose the name of the flow that is associated with the entitlement that you want to enable. The details page for that flow appears. 1. Choose the **Entitlements** tab. 1. Choose the entitlement that you want to enable. 1. Choose **Enable**.