Wire AWS MediaConnect into Streamwake in five minutes.
Don't replace AWS MediaConnect — we correlate the entitlement, source-state, and transport-stream QoS events MediaConnect already fans out (via EventBridge) and surface them as typed ranked anomalies on the same investigation timeline as CloudWatch + CloudTrail. Live ingest faults that used to stay invisible until they hit the CDN edge are caught the moment the entitlement flips, the source disconnects, or the transport stream skips.
AWS MediaConnect aws contribution layer for live ingest. Streamwake doesn't replace it — we correlate its entitlement / source / QoS signal and surface them as typed ranked anomalies on the same investigation timeline as CloudWatch + CloudTrail.
What AWS MediaConnect owns. What Streamwake runs on top.
Both layers run together in production — same AWS account, same signal bus, different obligation.
Contribution ingest
The AWS-managed live contribution layer — RTP / RTMP / SRT / UDP / RIST transports, entitlement grants + revocations, source-state lifecycle (arrive → up → departed), and the per-flow transport-stream QoS metrics (CC errors, discontinuity, dropped packets) MediaConnect fans out as first-class signals from the AWS region.
EventBridge delivery
The EventBridge event bus that surfaces MediaConnect entitlement, source, and QoS events to downstream targets. Streamwake ingests them via a single signed REST POST — same on either side of the boundary.
Classify → Rank → Surface
The agent loop on top of the MediaConnect contribution signal bus — every entitlement flip, source-state transition, and transport-stream QoS skew gets classified into one of four typed anomaly classes (entitlement_rejected / source_departed / source_arrive / transport_stream_discontinuity), ranked with a typed score, and surfaced into the existing InvestigationCorrelationsPanel under the ranked candidate list on /app/incidents/[id].
Same timeline as CloudWatch + CloudTrail
The same discriminated-union timeline surface that already joins CloudwatchEvidence + CloudtrailIncidentCandidate rows now also surfaces MediaConnectIncidentCandidate rows — one frame, one vendor-chip set, one ranked list, no extra page to bounce between.
Four AWS-side steps before the first anomaly lands.
Read top to bottom — the inbound is signed, the route resolves the owning tenant via the router token, and the classifier writes the event + paired candidate row in a single transaction.
- Step 01
Create the EventBridge rule
On the AWS account, create one EventBridge rule targeting aws.mediaconnect (entitlement / source / QoS event families). Input Transformer flattens to `{ upstreamId, flowArn, occurredAt, fields: { kind, fields: { … } } }` so the Streamwake route handler can parse without a manual step.
- Step 02
Mint the HMAC signing secret
Generate a 32-byte random secret (e.g. `openssl rand -hex 32`). The inbound webhook header `X-MediaConnect-Signature: sha256=<hex>` is HMAC-SHA256 of the raw body — Streamwake verifies it against this secret with constant-time compare and rejects with 401 on any drift.
- Step 03
Paste the router-token URL
The Streamwake per-user source card surfaces a one-time router-token URL of the form `POST /api/v1/mediaconnect-events?token=<routerToken>`. Paste it into the EventBridge rule target. The token resolves the owning tenant BEFORE the HMAC verify, so probing cannot enumerate valid tokens.
- Step 04
Verify the first event lands
Send a test MediaConnect entitlement / source / QoS event through EventBridge. The /api/v1/mediaconnect-events route returns `{ accepted, eventId, anomalyId, anomalyClass }` — the inbound is deduped on `(sourceId, upstreamId)` so a retry is a clean no-op.
What the inbound /api/v1/mediaconnect-events accepts.
Five flat fields on the POST body. The HMAC header is computed over the raw bytes of this body. Unrecognized shapes return 400 — the storage layer is never handed garbage.
| Field | Type | Required | Detail |
|---|---|---|---|
| upstreamId | string | yes | AWS MessageId for EventBridge-bridged MediaConnect events (or an operator-issued nonce). Dedupe key in (sourceId, upstreamId). |
| flowArn | AWS ARN | yes | arn:aws:mediaconnect:<region>:<account>:flow:<flow-id>:<entitlement-or-source-id> — captured verbatim. |
| occurredAt | ISO 8601 | yes | Event time. Converted to a Date upstream; stored on the MediaConnectFlowEvent row. |
| fields.kind | enum | yes | Discriminator — `entitlement` | `source` | `qos`. Drives the routing + the `MediaConnectEventKind` zod variant. |
| fields.fields | object | yes | Typed body — entitlement {status, reason, entitlementArn} · source {state, sourceArn, transport} · qos {discontinuity, transportStreamDiscontinuity, ccErrors, packets, droppedPackets}. |
Control surface is the next pass.
This page is the setup stub. The ranked-anomaly read GET /api/v1/mediaconnect-anomaliesalready exists — surfacing it in the InvestigationCorrelationsPanel alongside the existing CloudWatch + CloudTrail rows is the next pass, as is the recovery-action wiring on the AWS side. Today the inbound lands on Streamwake, the classifier writes the typed row, and the agent audit-trail holds; tomorrow the operator reads it inline on the incident detail.
Book a 20-minute walkthrough on your AWS MediaConnect account.
Happy to walk through the EventBridge rule + Input Transformer shape, the HMAC signing secret mint + rotation story, and the entitlement / source / QoS classification rules on top of your AWS account. Drop your details and we'll follow up within one business day.