@aws-cdk/aws-mediaconnect-alpha 2.270.0-alpha.0 → 2.271.0-alpha.0

package/.jsii

@@ -8,7 +8,7 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.270.0",
+    "aws-cdk-lib": "^2.271.0",
     "constructs": "^10.5.0"
   },
   "dependencyClosure": {
@@ -9613,7 +9613,7 @@
   },
   "name": "@aws-cdk/aws-mediaconnect-alpha",
   "readme": {
-    "markdown": "# AWS::MediaConnect Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n\n## AWS Elemental MediaConnect\n\nAWS Elemental MediaConnect is a high-quality transport service for live video. It provides the reliability and security of satellite and fiber-optic combined with the flexibility, agility, and economics of IP-based networks. MediaConnect enables you to build mission-critical live video workflows in a fraction of the time and cost of satellite or fiber services.\n\nThis package contains constructs for working with AWS Elemental MediaConnect, allowing you to define Flows, Bridges, Gateways, Router Inputs, Router Outputs, and Router Network Interfaces for transporting live video streams.\n\nFor further information on AWS Elemental MediaConnect, see [the documentation](https://aws.amazon.com/mediaconnect/).\n\n## Table of Contents\n\n- [Router Resources](#router-resources)\n  - [Router Network Interfaces](#router-network-interfaces)\n  - [Router Inputs](#router-inputs)\n  - [Router Outputs](#router-outputs)\n- [Flows](#flows)\n  - [Creating a Flow](#creating-a-flow)\n  - [Flow Sources](#flow-sources)\n  - [VPC Interfaces](#vpc-interfaces)\n  - [Media Streams](#media-streams)\n  - [Flow Sizes](#flow-sizes)\n- [Gateways](#gateways)\n  - [Creating a Gateway](#creating-a-gateway)\n  - [Importing an Existing Gateway](#importing-an-existing-gateway)\n- [Bridges](#bridges)\n  - [Creating a Bridge](#creating-a-bridge)\n  - [Bridge Sources](#bridge-sources)\n  - [Bridge Outputs](#bridge-outputs)\n- [Encryption](#encryption)\n- [CloudWatch Metrics](#cloudwatch-metrics)\n- [Public CIDR warnings](#public-cidr-warnings)\n\n## Router Resources\n\nMediaConnect routers provide high-performance, low-latency video routing capabilities for building complex live video workflows. Router resources include network interfaces, inputs, and outputs.\n\n### How Router Resources Relate\n\nRouter resources work together in a pipeline:\n\n- A **RouterNetworkInterface** defines the network connectivity (public internet or VPC). Required for standard protocol-based inputs and outputs, but not needed when connecting to MediaLive inputs or MediaConnect flows directly.\n- A **RouterInput** is the entry point — it receives video from a source via a protocol (RTP, SRT, RIST), or from a MediaConnect flow.\n- A **RouterOutput** is the exit point — it sends video to a destination via a protocol, to a MediaLive input, or to a MediaConnect flow.\n\nA typical camera-to-cloud workflow looks like:\n\n```text\nCamera → RouterNetworkInterface → RouterInput (SRT) → [Router] → RouterOutput (MediaLive) → MediaLive Channel\n```\n\nThe router sits in the middle, routing content from inputs to outputs. You can have many outputs per input — for example, one camera feed going to both a MediaLive channel and a MediaConnect flow simultaneously.\n\n### End-to-End Example: SRT Source to MediaLive\n\nHere's a complete example showing how to connect an SRT source through a router to MediaLive:\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\n// 1. A public network interface for the SRT input\nconst networkInterface = new RouterNetworkInterface(stack, 'NetworkInterface', {\n  routerNetworkInterfaceName: 'camera-network',\n  configuration: RouterNetworkConfiguration.publicNetwork({\n    cidr: ['203.0.113.0/24'],\n  }),\n});\n\n// 2. A router input receiving SRT from an upstream encoder\nconst input = new RouterInput(stack, 'Input', {\n  routerInputName: 'camera-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.standard({\n    networkInterface,\n    protocol: RouterInputProtocol.srtListener({\n      port: 9000,\n      minimumLatency: Duration.millis(200),\n    }),\n  }),\n});\n\n// 3. A router output delivering to MediaLive\nconst output = new RouterOutput(stack, 'Output', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\nThis gives you a complete pipeline: the encoder pushes SRT to the network interface, the router receives it as an input, and the router output delivers it to MediaLive. For routing rules — including how bitrate affects which outputs can receive which inputs — see the [documentation](https://docs.aws.amazon.com/mediaconnect/latest/ug/using-router-control-panel.html).\n\n### Router Network Interfaces\n\nNetwork interfaces define the network connectivity for router inputs and outputs:\n\n#### Public Network Interface\n\n```ts\ndeclare const stack: Stack;\n\nconst publicInterface = new RouterNetworkInterface(stack, 'PublicInterface', {\n  routerNetworkInterfaceName: 'public-interface',\n  configuration: RouterNetworkConfiguration.publicNetwork({\n    cidr: ['203.0.113.0/24'],\n  }),\n});\n```\n\n#### Private Network Interface\n\n```ts\ndeclare const stack: Stack;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst privateInterface = new RouterNetworkInterface(stack, 'PrivateInterface', {\n  routerNetworkInterfaceName: 'private-interface',\n  configuration: RouterNetworkConfiguration.vpc({\n    securityGroups: [securityGroup],\n    subnet: subnet,\n  }),\n});\n```\n\n### Router Inputs\n\nRouter inputs receive live video streams from various sources and make them available for routing:\n\n#### Standard Input with RTP Protocol\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'RtpInput', {\n  routerInputName: 'rtp-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  // tier defaults to RouterInputTier.INPUT_20 (lowest cost)\n  configuration: RouterInputConfiguration.standard({\n    networkInterface: networkInterface,\n    protocol: RouterInputProtocol.rtp({\n      port: 5000,\n    }),\n  }),\n});\n```\n\n#### Failover Input Configuration\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});\n```\n\n#### MediaLive Channel Input\n\nConnect a router input to a MediaLive channel. The `outputName` must match the name of an output configured in the channel's MediaConnect Router output group.\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\n> **Tip:** For full examples of wiring a MediaLive channel to a MediaConnect Router (including\n> transit encryption), see the [MediaLive L2 README — MediaConnect Router section](./../aws-medialive-alpha/README.md#aws-elemental-mediaconnect-router).\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});\n```\n\nOr prepare a router input for a MediaLive connection without specifying the channel (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst input = new RouterInput(stack, 'ChannelInputNoConnection', {\n  routerInputName: 'channel-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannelWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### MediaConnect Flow Input\n\nConnect a router input to an existing MediaConnect flow:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const flowOutput: FlowOutput;\n\nconst input = new RouterInput(stack, 'FlowInput', {\n  routerInputName: 'flow-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaConnectFlow({\n    flow: flow,\n    flowOutput: flowOutput,\n  }),\n});\n```\n\nOr prepare a router input for a flow connection without specifying the flow (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst input = new RouterInput(stack, 'FlowInputNoConnection', {\n  routerInputName: 'flow-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n### Router Outputs\n\nRouter outputs send video streams to various destinations including standard protocols, MediaLive inputs, and MediaConnect flows:\n\n#### Standard Output with SRT Protocol\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst output = new RouterOutput(stack, 'SrtOutput', {\n  routerOutputName: 'srt-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  // tier defaults to RouterOutputTier.OUTPUT_20 (lowest cost)\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtListener({\n      port: 9001,\n      minimumLatency: Duration.millis(200),\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\n> **Note:** The `tier` property defaults to the lowest (and cheapest) tier: `INPUT_20` for Router Inputs and `OUTPUT_20` for Router Outputs. The construct validates that `maximumBitrate` does not exceed the tier's capacity (20, 50, or 100 Mbps) at synth time. Per the [documentation](https://docs.aws.amazon.com/mediaconnect/latest/ug/using-router-control-panel.html), if an input is 20 Mbps you can't route it to an output set up for less than 20 Mbps.\n\n#### MediaLive Output\n\nConnect a router output to a MediaLive input (the input must be a MediaConnect Router type):\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutput', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\nOr prepare a router output for a MediaLive connection without specifying the input (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutputNoConnection', {\n  routerOutputName: 'medialive-output-no-connection',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.mediaLiveInputWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### MediaConnect Flow Output\n\nConnect a router output to an existing MediaConnect flow:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\n\nconst output = new RouterOutput(stack, 'FlowOutput', {\n  routerOutputName: 'flow-output',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_100,\n  configuration: RouterOutputConfiguration.mediaConnectFlow({\n    flow: flow,\n  }),\n});\n```\n\nOr prepare a router output for a flow connection without specifying the flow (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'FlowOutputNoConnection', {\n  routerOutputName: 'flow-output-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_100,\n  configuration: RouterOutputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### Output with Encryption\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\n## Flows\n\nA MediaConnect flow represents a transport stream connection between a source and one or more outputs. Flows are the primary resource for transporting live video content.\n\n### Creating a Flow\n\nThe following example creates a basic MediaConnect flow with an RTP source:\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  flowName: 'my-live-stream',\n  source: SourceConfiguration.rtp({\n    flowSourceName: 'my-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n### Flow Sources\n\nMediaConnect supports multiple source types for ingesting content into a flow. The examples below use `NetworkConfiguration.publicNetwork()` for simplicity, but all protocol-based sources can also use `NetworkConfiguration.vpc()` with a VPC interface for private connectivity.\n\n#### SRT Listener Source\n\nSRT (Secure Reliable Transport) in listener mode configures MediaConnect to listen on a specific port for incoming content. The upstream device connects to MediaConnect as a caller.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtListener({\n    flowSourceName: 'live-encoder-source',\n    description: 'Live encoder feed',\n    port: 5000,\n    minLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### SRT Caller Source\n\nSRT in caller mode configures MediaConnect to connect to a remote SRT listener. Use this when the source device is listening for incoming connections rather than pushing content.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtCaller({\n    flowSourceName: 'remote-source',\n    sourceListenerAddress: '203.0.113.50',\n    sourceListenerPort: 5000,\n    minLatency: Duration.millis(200),\n  }),\n});\n```\n\n#### RTP Source\n\nRTP (Real-time Transport Protocol) is a standard protocol for delivering audio and video over IP networks.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rtp({\n    flowSourceName: 'rtp-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### RTP-FEC Source\n\nRTP with Forward Error Correction adds redundancy to recover lost packets without retransmission. Use this when contributing via RTP and you need packet recovery.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rtpFec({\n    flowSourceName: 'rtp-fec-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### RIST Source\n\nRIST (Reliable Internet Stream Transport) provides reliable video transport with packet recovery.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rist({\n    flowSourceName: 'rist-source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### Zixi Push Source\n\nZixi Push uses the Zixi protocol for reliable video transport. Content is pushed to MediaConnect from a Zixi-compatible component upstream.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.zixiPush({\n    flowSourceName: 'zixi-source',\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n> Zixi Push ports are assigned by MediaConnect: 2088 for public sources, 2090-2099 for VPC sources. See [Source port assignments](https://docs.aws.amazon.com/mediaconnect/latest/ug/source-ports.html).\n\n#### Router Source\n\nUse a router source when the flow's source comes from a MediaConnect Router rather than a direct connection.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.router(),\n});\n```\n\n#### VPC Source\n\nUse a VPC-based source when you need a connection between a flow and your Amazon VPC. This enables private connectivity for receiving content from on-premises equipment via AWS Direct Connect or VPN, or from other AWS services running in your VPC.\n\n```ts\ndeclare const stack: Stack;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\ndeclare const role: iam.IRole;\n\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'my-vpc-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n});\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rist({\n    flowSourceName: 'vpc-source',\n    description: 'VPC-based source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.vpc(vpcInterface),\n  }),\n  vpcInterfaces: [vpcInterface],\n});\n```\n\n#### Entitled Source (From Another AWS Account)\n\nEntitlements allow you to subscribe to content from another AWS account. The entitlement is created by the content originator in their AWS account, and you import it using the entitlement ARN they provide.\n\n```ts\ndeclare const stack: Stack;\n\n// Import an entitlement from another AWS account\nconst entitlement = FlowEntitlement.fromFlowEntitlementArn(stack, 'ImportedEntitlement',\n  'arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11111111111111111111111111111111:MyEntitlement',\n);\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.entitlement({\n    entitlement: entitlement,\n  }),\n});\n```\n\n#### Gateway Bridge Source\n\nUse a gateway bridge source when ingesting content from on-premises equipment through a MediaConnect gateway and bridge. Gateways define the network infrastructure that bridges use to transport video between on-premises and cloud environments.\n\n```ts\ndeclare const stack: Stack;\ndeclare const bridge: Bridge;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'bridge-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n});\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.gatewayBridge({\n    bridge: bridge,\n    vpcInterface: vpcInterface,\n  }),\n  vpcInterfaces: [vpcInterface],\n});\n```\n\n### VPC Interfaces\n\nVPC interfaces allow MediaConnect to send or receive content within your VPC. Create VPC interfaces using `VpcInterface.define()` and add them to the flow's `vpcInterfaces` array. The same interface can then be referenced in sources and outputs:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\n// Create VPC interface\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'my-vpc-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.ENA,\n});\n\n// Add to flow and reference in source\nconst flow = new Flow(stack, 'MyFlow', {\n  vpcInterfaces: [vpcInterface],  // Declare at flow level\n  source: SourceConfiguration.rist({\n    flowSourceName: 'vpc-source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.vpc(vpcInterface),  // Reference in source\n  }),\n});\n```\n\n#### CDI and JPEG XS with EFA Interfaces\n\nFor high-performance CDI or JPEG XS workflows, use EFA (Elastic Fabric Adapter) interfaces. Note that flows can have a maximum of 1 EFA interface:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst efaInterface = VpcInterface.define({\n  vpcInterfaceName: 'efa-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.EFA,  // Required for CDI\n});\n\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video',\n  videoFormat: MediaVideoFormat.HD_1080P,\n  fmtp: {\n    exactFramerate: Framerate.FPS_29_97,\n    par: PixelAspectRatio.SQUARE,\n  },\n});\n\nconst flow = new Flow(stack, 'MyCdiFlow', {\n  flowSize: FlowSize.LARGE_4X,  // Required for CDI and JPEG XS\n  vpcInterfaces: [efaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.cdi({\n    flowSourceName: 'cdi-source',\n    vpcInterface: efaInterface,\n    port: 5000,\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.RAW,\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\n#### JPEG XS with Redundant Interfaces\n\nJPEG XS requires exactly 2 input interfaces per media stream for redundancy. Typically one EFA and one ENA interface:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const sg1: ec2.ISecurityGroup;\ndeclare const sg2: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst efaInterface = VpcInterface.define({\n  vpcInterfaceName: 'efa-interface',\n  role: role,\n  securityGroups: [sg1],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.EFA,\n});\n\nconst enaInterface = VpcInterface.define({\n  vpcInterfaceName: 'ena-interface',\n  role: role,\n  securityGroups: [sg2],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.ENA,\n});\n\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video',\n  videoFormat: MediaVideoFormat.UHD_2160P,\n  fmtp: {\n    exactFramerate: Framerate.FPS_59_94,\n    par: PixelAspectRatio.SQUARE,\n    colorimetry: Colorimetry.BT2020,\n    videoRange: VideoRange.FULL,\n    scanMode: ScanMode.PROGRESSIVE,\n    tcs: Tcs.PQ,\n  },\n});\n\nconst flow = new Flow(stack, 'MyJpegXsFlow', {\n  flowSize: FlowSize.LARGE_4X,  // Required for JPEG XS\n  vpcInterfaces: [efaInterface, enaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.jpegXs({\n    flowSourceName: 'jpegxs-source',\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.JXSV,\n      port: 5000,\n      inputInterface: [efaInterface, enaInterface],  // 2 interfaces for redundancy\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\n### Media Streams\n\nMedia streams represent individual components of your content (video, audio, ancillary data) for ST 2110 JPEG XS or CDI workflows. Create media streams using the static factory methods and add them to the flow's `mediaStreams` array:\n\n```ts\ndeclare const stack: Stack;\n\n// Create media streams\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video-stream',\n  videoFormat: MediaVideoFormat.HD_1080P,\n  fmtp: {\n    colorimetry: Colorimetry.BT709,\n    exactFramerate: Framerate.FPS_29_97,\n    par: PixelAspectRatio.SQUARE,\n    videoRange: VideoRange.NARROW,\n    scanMode: ScanMode.PROGRESSIVE,\n    tcs: Tcs.SDR,\n  },\n});\n\nconst audioStream = MediaStream.audio({\n  mediaStreamId: 2,\n  mediaStreamName: 'audio-stream',\n  channelOrder: AudioStreamOrderOptions.STANDARD_STEREO,\n});\n\n// Add to flow\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.router(),\n  mediaStreams: [videoStream, audioStream],  // Declare at flow level\n});\n```\n\n#### Audio Channel Order\n\nFor audio media streams, use the `AudioStreamOrderOptions` enum to specify the SMPTE 2110-30 channel order:\n\n```ts\n// Available channel order options\nAudioStreamOrderOptions.MONO                    // SMPTE2110.(M)\nAudioStreamOrderOptions.DUAL_MONO               // SMPTE2110.(DM)\nAudioStreamOrderOptions.STANDARD_STEREO         // SMPTE2110.(ST)\nAudioStreamOrderOptions.LTRT_MATRIX_STEREO      // SMPTE2110.(LtRt)\nAudioStreamOrderOptions.SURROUND_5_1            // SMPTE2110.(51)\nAudioStreamOrderOptions.SURROUND_7_1            // SMPTE2110.(71)\nAudioStreamOrderOptions.SURROUND_22_2           // SMPTE2110.(222)\nAudioStreamOrderOptions.ONE_SDI_AUDIO_GROUP     // SMPTE2110.(SGRP)\n\n// Example with 5.1 surround\nconst surroundAudio = MediaStream.audio({\n  mediaStreamId: 3,\n  mediaStreamName: 'surround-audio',\n  channelOrder: AudioStreamOrderOptions.SURROUND_5_1,\n});\n```\n\nMedia streams can be referenced in source configurations (for CDI and JPEG XS) and output configurations.\n\n### Flow Sizes\n\nMediaConnect offers three flow sizes that determine feature support:\n\n| Flow Size | Transport Streams | NDI | CDI / JPEG XS |\n|-----------|------------------|-----|---------------|\n| `MEDIUM` (default) | ✅ | ❌ | ❌ |\n| `LARGE` | ✅ | ✅ | ❌ |\n| `LARGE_4X` | ❌ | ❌ | ✅ |\n\nThis table maps each `FlowSize` to the capabilities the construct validates. For output counts, throughput limits, and other per-size details, see [Flow sizes and capabilities](https://docs.aws.amazon.com/mediaconnect/latest/ug/flow-sizes-capabilities.html).\n\nThe construct validates flow size constraints at synthesis time based on the source protocol and NDI configuration:\n\n- `MEDIUM` supports transport stream protocols (RTP, SRT, RIST, etc.) but not NDI or CDI\n- `LARGE` supports transport streams and NDI, and is required when NDI is enabled\n- `LARGE_4X` is required for CDI and JPEG XS protocols, and does not support transport streams or NDI\n\nThese are mutually exclusive — CDI/JPEG XS and NDI cannot coexist on the same flow because they require different flow sizes.\n\n```ts\ndeclare const stack: Stack;\ndeclare const ndiVpcInterface: VpcInterfaceConfig;\ndeclare const efaInterface: VpcInterfaceConfig;\ndeclare const videoStream: MediaStream;\n\n// NDI requires LARGE, an encoding profile, and at least one discovery server\nnew Flow(stack, 'NdiFlow', {\n  flowSize: FlowSize.LARGE,\n  ndiConfig: {\n    ndiState: State.ENABLED,\n    ndiDiscoveryServers: [{\n      discoveryServerAddress: '10.0.0.10',\n      vpcInterface: ndiVpcInterface,\n    }],\n  },\n  encodingConfig: {\n    encodingProfile: EncodingProfile.CONTRIBUTION_H264_DEFAULT,\n  },\n  source: SourceConfiguration.ndi({\n    flowSourceName: 'ndi-source',\n  }),\n});\n\n// CDI and JPEG XS require LARGE_4X\nnew Flow(stack, 'CdiFlow', {\n  flowSize: FlowSize.LARGE_4X,\n  vpcInterfaces: [efaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.cdi({\n    flowSourceName: 'cdi-source',\n    vpcInterface: efaInterface,\n    port: 5000,\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.RAW,\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\nFor more information, see [Flow sizes and capabilities](https://docs.aws.amazon.com/mediaconnect/latest/ug/flow-sizes-capabilities.html).\n\n## Gateways\n\nMediaConnect Gateways enable the deployment of on-premises resources for transporting live video to and from the AWS Cloud. Gateways are required for creating bridges.\n\n### Creating a Gateway\n\n```ts\ndeclare const stack: Stack;\n\nconst productionNetwork = GatewayNetwork.define({\n  cidrBlock: '192.168.1.0/24',\n  name: 'production-network',\n});\n\nconst gateway = new Gateway(stack, 'MyGateway', {\n  gatewayName: 'my-gateway',\n  egressCidrBlocks: ['10.0.0.0/16'],\n  networks: [productionNetwork],\n});\n```\n\n### Importing an Existing Gateway\n\n```ts\ndeclare const stack: Stack;\n\nconst gateway = Gateway.fromGatewayArn(stack, 'ImportedGateway',\n  'arn:aws:mediaconnect:us-west-2:123456789012:gateway:1-XXXXXX',\n);\n```\n\n## Bridges\n\nMediaConnect bridges enable you to interconnect on-premises equipment with cloud-based workflows. Bridges support both ingress (on-premises to cloud) and egress (cloud to on-premises) scenarios.\n\n### Creating a Bridge\n\n#### Ingress Bridge (On-premises to Cloud)\n\nAn ingress bridge receives content from on-premises equipment and makes it available in the cloud:\n\n```ts\ndeclare const stack: Stack;\n\nconst productionNetwork = GatewayNetwork.define({\n  cidrBlock: '192.168.1.0/24',\n  name: 'production-network',\n});\n\nconst gateway = new Gateway(stack, 'MyGateway', {\n  gatewayName: 'my-gateway',\n  egressCidrBlocks: ['10.0.0.0/16'],\n  networks: [productionNetwork],\n});\n\nconst ingressBridge = new Bridge(stack, 'MyIngressBridge', {\n  bridgeName: 'my-ingress-bridge',\n  config: BridgeConfiguration.ingress({\n    maxBitrate: Bitrate.mbps(10),\n    maxOutputs: 2,\n    networkSources: [{\n      name: 'on-prem-source',\n      source: {\n        protocol: BridgeProtocol.RTP,\n        network: productionNetwork,\n        multicastIp: '239.1.1.1',\n        port: 5000,\n      },\n    }],\n  }),\n  gateway: gateway,\n});\n```\n\n#### Egress Bridge (Cloud to On-premises)\n\nAn egress bridge sends content from MediaConnect flows to on-premises equipment:\n\n```ts\ndeclare const stack: Stack;\ndeclare const gateway: Gateway;\ndeclare const flow: Flow;\ndeclare const vpcInterface: VpcInterfaceConfig;\ndeclare const productionNetwork: GatewayNetwork;\n\nconst egressBridge = new Bridge(stack, 'MyEgressBridge', {\n  bridgeName: 'my-egress-bridge',\n  config: BridgeConfiguration.egress({\n    maxBitrate: Bitrate.mbps(10),\n    flowSources: [{\n      name: 'cloud-source',\n      source: {\n        flow: flow,\n        vpcInterface: vpcInterface,\n      },\n    }],\n    networkOutputs: [{\n      name: 'on-prem-output',\n      output: BridgeOutputConfiguration.network({\n        ipAddress: '192.168.1.200',\n        port: 5001,\n        network: productionNetwork,\n        protocol: BridgeProtocol.RTP,\n        ttl: 50,\n      }),\n    }],\n  }),\n  gateway: gateway,\n});\n```\n\n### Bridge Sources\n\nFor failover scenarios, you can add additional sources to an existing bridge using the `BridgeSource` construct:\n\n```ts\ndeclare const stack: Stack;\ndeclare const bridge: Bridge;\ndeclare const flow: Flow;\n\n// Add a flow source to an egress bridge (requires failover to be enabled)\nconst additionalSource = new BridgeSource(stack, 'AdditionalSource', {\n  bridgeSourceName: 'backup-source',\n  bridge: bridge,\n  source: BridgeSourceConfiguration.flow({\n    flow: flow,\n  }),\n});\n```\n\n### Bridge Outputs\n\nBridge outputs are configured as part of the bridge configuration for egress bridges. They define where content exits the bridge to on-premises equipment.\n\n```ts\ndeclare const productionNetwork: GatewayNetwork;\n\nconst networkConfig = BridgeOutputConfiguration.network({\n  ipAddress: '192.168.1.200',\n  port: 5001,\n  network: productionNetwork,\n  protocol: BridgeProtocol.RTP,\n  ttl: 50,\n});\n\nconst namedOutput = { name: 'on-prem-output', output: networkConfig };\n```\n\n## Encryption\n\nMediaConnect supports encryption for sources, outputs, and entitlements. This package provides type-safe encryption configuration structs that match the encryption requirements for different protocols.\n\n### Encryption Types\n\nMediaConnect supports two types of encryption:\n\n1. **Static Key Encryption** - Used for Zixi Push/Pull protocols and entitlements\n2. **SRT Password Encryption** - Used for SRT Listener and SRT Caller protocols\n\nNote: CFN exposes only `static-key` and `srt-password` for flow output encryption today; SPEKE is not currently part of the surface.\n\n**Auto-created IAM role.** Every encryption struct accepts an optional `role`. Omit it and the consuming construct creates a scoped role for you: trust policy for `mediaconnect.amazonaws.com` with `aws:SourceAccount` + `aws:SourceArn` conditions (confused-deputy protection), and just enough permission to read the provided secret (including `kms:Decrypt` when the secret uses a customer-managed KMS key).\n\n**Providing your own role.** If you supply a `role`, it's used as-is — the construct does **not** grant it any permissions. You must grant it the necessary permissions yourself. Provide your own role when you need stricter control or a shared identity.\n\n**Trust-policy scope: flows vs. routers.** When the L2 auto-creates a role, it also pins `aws:SourceArn` to the consuming resource:\n\n- **Flows** — the trust policy pins the flow ARN (`arn:...:flow:*:<flow-name>`). The `*` wildcards the service-assigned id segment; the flow name is fixed at create time.\n- **Routers** — the trust policy can only pin a wildcarded ARN (`arn:...:routerInput:*` / `arn:...:routerOutput:*`). Router I/O ARNs use a service-generated id segment that is unknown at synth time, and using the live ARN attribute would create a CloudFormation dependency cycle (role → router → role). If you need per-resource pinning, supply your own `role` with a trust condition that pins the exact ARN — you can compute it from the resource's `routerInputId` / `routerOutputId` after first deploy and apply it on a follow-up deploy.\n\n### Static Key Encryption\n\nUse a static-key encryption struct for Zixi protocols and entitlements. This requires an encryption algorithm (AES128, AES192, or AES256). Pass it inline where the construct asks for it:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nnew FlowEntitlement(stack, 'MyEntitlement', {\n  flow,\n  subscribers: ['111122223333'],\n  description: 'Grant partner access to live feed',\n  encryption: {\n    role,\n    secret,\n    algorithm: EncryptionAlgorithm.AES256,\n  },\n});\n```\n\n### SRT Password Encryption\n\nSRT protocols take an encryption struct with just `role` and `secret` — no algorithm:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nnew FlowOutput(stack, 'SrtOutput', {\n  flow,\n  output: OutputConfiguration.srtCaller({\n    destination: '203.0.113.100',\n    port: 7000,\n    encryption: { role, secret },\n  }),\n});\n```\n\n### Using Encryption with Sources\n\nApply encryption when configuring flow sources:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\n// SRT Listener source with encryption\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtListener({\n    flowSourceName: 'encrypted-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n    decryption: { role, secret },\n  }),\n});\n\n// Zixi Push source with encryption\nconst flow2 = new Flow(stack, 'MyFlow2', {\n  source: SourceConfiguration.zixiPush({\n    flowSourceName: 'encrypted-zixi-source',\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n    decryption: {\n      role,\n      secret,\n      algorithm: EncryptionAlgorithm.AES256,\n    },\n  }),\n});\n```\n\n### Using Encryption with Outputs\n\nApply encryption when configuring flow outputs:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\n// SRT Caller output with encryption\nconst output = new FlowOutput(stack, 'EncryptedOutput', {\n  flow: flow,\n  description: 'Encrypted SRT output',\n  output: OutputConfiguration.srtCaller({\n    destination: '203.0.113.100',\n    port: 7000,\n    encryption: { role, secret },\n  }),\n});\n```\n\n### Using Encryption with Entitlements\n\nEntitlements use static key encryption:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst entitlement = new FlowEntitlement(stack, 'MyEntitlement', {\n  flow: flow,\n  description: 'Grant partner access to live feed',\n  subscribers: ['111122223333'],\n  encryption: {\n    role,\n    secret,\n    algorithm: EncryptionAlgorithm.AES256,\n  },\n});\n```\n\n### Router Transit Encryption\n\nWhen integrating flows with routers, use transit encryption to secure the connection between the flow and router:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\ndeclare const existingRouterOutput: RouterOutput;\n\n// Flow output to router with transit encryption\nconst routerOutput = new FlowOutput(stack, 'RouterOutput', {\n  flow: flow,\n  output: OutputConfiguration.router({\n    encryption: { role, secret },\n  }),\n});\n\n// Flow source from router with transit encryption\nconst flowFromRouter = new Flow(stack, 'FlowFromRouter', {\n  source: SourceConfiguration.router({\n    routerOutput: existingRouterOutput,\n    decryption: { role, secret },\n  }),\n});\n```\n\n### Router SRT Encryption\n\nRouter outputs using SRT protocols use `RouterSrtEncryption` for encryption:\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedSrtOutput', {\n  routerOutputName: 'encrypted-srt-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\nNote: `RouterSrtEncryption` is distinct from `SrtPasswordEncryption` (used on flow sources/outputs) — router outputs use a simpler CFN shape without a `keyType` discriminator.\n\n## CloudWatch Metrics\n\nFlows and Bridges expose CloudWatch metric helpers for monitoring. You can create alarms and dashboards using these metrics:\n\n```ts\ndeclare const flow: Flow;\ndeclare const stack: Stack;\n\n// Create a CloudWatch alarm on source bitrate\nconst alarm = flow.metricSourceBitrate().createAlarm(stack, 'LowBitrate', {\n  threshold: 1000000,\n  evaluationPeriods: 1,\n});\n\n// Monitor unrecovered packets\nflow.metricSourceNotRecoveredPackets().createAlarm(stack, 'PacketLoss', {\n  threshold: 100,\n  evaluationPeriods: 2,\n});\n\n// Track total packets with custom options\nconst totalPackets = flow.metricSourceTotalPackets({\n  statistic: 'sum',\n  period: Duration.minutes(5),\n});\n```\n\n### Flow metrics\n\n- `metricSourceBitrate()` - Bitrate of content ingested into the flow (average)\n- `metricSourceNotRecoveredPackets()` - Packets lost in transit that were not recovered by error correction (sum)\n- `metricSourceTotalPackets()` - Total packets received by the flow sources (sum)\n- `metricSourceSelected()` - Indicates which source is being used under Failover mode (max; 1 = active, 0 = standby)\n- `metricSourceConnected()` - Source connection state for Zixi, SRT, and RIST (min; 1 = connected, 0 = disconnected)\n- `metricSourceDisconnections()` - Number of times the source transitioned from connected to disconnected (sum)\n- `metricSourceDroppedPackets()` - Packets lost before any error correction took place (sum)\n- `metricSourcePacketLossPercent()` - Percentage of packets lost during transit, even if they were recovered (average)\n- `metricSourceRoundTripTime()` - Round-trip time to the source for RIST, Zixi, and SRT (average, milliseconds)\n- `metricSourceJitter()` - Current network jitter of the source (average, milliseconds)\n- `metric(metricName)` - Create a custom metric by name\n\n### Bridge metrics\n\nBridge metrics are dimensioned by `BridgeARN`. The underlying CloudWatch metric name is chosen automatically based on whether the bridge is ingress or egress.\n\n- `metricSourceBitrate(bridgeSourceName)` - Bitrate of a specific bridge source (average)\n- `metricSourcePacketLossPercent(bridgeSourceName)` - Percentage of packets lost on a specific bridge source (average)\n- `metricFailoverSwitches()` - Total number of times the bridge switches between sources under `FAILOVER` failover mode (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Router Input metrics\n\nRouter input metrics are dimensioned by `RouterInputARN`.\n\n- `metricBitrate()` - Bitrate of the router input's payload (average)\n- `metricNotRecoveredPackets()` - Packets lost in transit that were not recovered by error correction (sum)\n- `metricTotalPackets()` - Total number of packets received by the router input (sum)\n- `metricConnected()` - Connection state for SRT sources (min; 1 = connected, 0 = disconnected)\n- `metricContinuityCounterErrors()` - Continuity counter errors in the transport stream (sum)\n- `metricLatency()` - Recovery latency of the input stream for RIST, SRT, and RTP-FEC (average, milliseconds)\n- `metricFailoverSwitches()` - Total times the router input switched sources under Failover mode (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Router Output metrics\n\nRouter output metrics are dimensioned by `RouterOutputARN`.\n\n- `metricBitrate()` - Bitrate of the router output's payload (average)\n- `metricTotalPackets()` - Total number of packets sent by the router output (sum)\n- `metricConnected()` - Connection state for SRT outputs (min; 1 = connected, 0 = disconnected)\n- `metricArqRequests()` - Retransmitted packets requested through ARQ for RIST and SRT outputs (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Gateway metrics\n\nGateway metrics are dimensioned by `GatewayARN`. Pass extra dimensions such as `NetworkName`, `InstanceId`, or `BridgeSourceName` via `props.dimensionsMap` to narrow to a specific network, appliance, or bridge source.\n\n- `metricEgressBridgeTotalPackets()` - Total packets sent from egress bridges hosted on the gateway (sum)\n- `metricEgressBridgeDroppedPackets()` - Packets dropped by egress bridges hosted on the gateway (sum)\n- `metricIngressBridgeTotalPackets()` - Total packets received by ingress bridges hosted on the gateway (sum)\n- `metricIngressBridgeDroppedPackets()` - Packets dropped by ingress bridges hosted on the gateway (sum)\n- `metric(metricName)` - Create a custom metric by name (e.g. `IngressBridgeBitRate`, `EgressBridgeBitRate`, `IngressBridgeSourcePacketLossPercent`)\n\nPair the total + dropped helpers to build a dropped-packet percentage chart — for example, divide `metricEgressBridgeDroppedPackets()` by `metricEgressBridgeTotalPackets()` in a math expression.\n\nAll metrics support standard CloudWatch metric options for customizing period, statistic, and dimensions.\n\n## Public CIDR warnings\n\nSeveral constructs accept CIDR ranges that determine who can contribute content or pull outputs. Passing an open range (`0.0.0.0/0` or any `/0` prefix) makes the resource reachable from anywhere on the public internet, which is rarely what you want. The module emits synthesis-time warnings when it detects an open range on:\n\n- `GatewayProps.egressCidrBlocks`\n- `NetworkConfiguration.publicNetwork(cidr)` used on flow sources\n- `cidrAllowList` on Zixi Push / Zixi Pull / SRT Listener flow outputs\n- `RouterNetworkConfiguration.publicNetwork({ cidr })`\n\nRestrict each range to the narrowest set of addresses that actually need access.\n"
+    "markdown": "# AWS::MediaConnect Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n\n## AWS Elemental MediaConnect\n\nAWS Elemental MediaConnect is a high-quality transport service for live video. It provides the reliability and security of satellite and fiber-optic combined with the flexibility, agility, and economics of IP-based networks. MediaConnect enables you to build mission-critical live video workflows in a fraction of the time and cost of satellite or fiber services.\n\nThis package contains constructs for working with AWS Elemental MediaConnect, allowing you to define Flows, Bridges, Gateways, Router Inputs, Router Outputs, and Router Network Interfaces for transporting live video streams.\n\nFor further information on AWS Elemental MediaConnect, see [the documentation](https://aws.amazon.com/mediaconnect/).\n\n## Table of Contents\n\n- [Router Resources](#router-resources)\n  - [Router Network Interfaces](#router-network-interfaces)\n  - [Router Inputs](#router-inputs)\n  - [Router Outputs](#router-outputs)\n- [Flows](#flows)\n  - [Creating a Flow](#creating-a-flow)\n  - [Flow Sources](#flow-sources)\n  - [VPC Interfaces](#vpc-interfaces)\n  - [Media Streams](#media-streams)\n  - [Flow Sizes](#flow-sizes)\n- [Gateways](#gateways)\n  - [Creating a Gateway](#creating-a-gateway)\n  - [Importing an Existing Gateway](#importing-an-existing-gateway)\n- [Bridges](#bridges)\n  - [Creating a Bridge](#creating-a-bridge)\n  - [Bridge Sources](#bridge-sources)\n  - [Bridge Outputs](#bridge-outputs)\n- [Encryption](#encryption)\n- [CloudWatch Metrics](#cloudwatch-metrics)\n- [Public CIDR warnings](#public-cidr-warnings)\n\n## Router Resources\n\nMediaConnect routers provide high-performance, low-latency video routing capabilities for building complex live video workflows. Router resources include network interfaces, inputs, and outputs.\n\n### How Router Resources Relate\n\nRouter resources work together in a pipeline:\n\n- A **RouterNetworkInterface** defines the network connectivity (public internet or VPC). Required for standard protocol-based inputs and outputs, but not needed when connecting to MediaLive inputs or MediaConnect flows directly.\n- A **RouterInput** is the entry point — it receives video from a source via a protocol (RTP, SRT, RIST), or from a MediaConnect flow.\n- A **RouterOutput** is the exit point — it sends video to a destination via a protocol, to a MediaLive input, or to a MediaConnect flow.\n\nA typical camera-to-cloud workflow looks like:\n\n```text\nCamera → RouterNetworkInterface → RouterInput (SRT) → [Router] → RouterOutput (MediaLive) → MediaLive Channel\n```\n\nThe router sits in the middle, routing content from inputs to outputs. You can have many outputs per input — for example, one camera feed going to both a MediaLive channel and a MediaConnect flow simultaneously.\n\n### End-to-End Example: SRT Source to MediaLive\n\nHere's a complete example showing how to connect an SRT source through a router to MediaLive:\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\n// 1. A public network interface for the SRT input\nconst networkInterface = new RouterNetworkInterface(stack, 'NetworkInterface', {\n  routerNetworkInterfaceName: 'camera-network',\n  configuration: RouterNetworkConfiguration.publicNetwork({\n    cidr: ['203.0.113.0/24'],\n  }),\n});\n\n// 2. A router input receiving SRT from an upstream encoder\nconst input = new RouterInput(stack, 'Input', {\n  routerInputName: 'camera-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.standard({\n    networkInterface,\n    protocol: RouterInputProtocol.srtListener({\n      port: 9000,\n      minimumLatency: Duration.millis(200),\n    }),\n  }),\n});\n\n// 3. A router output delivering to MediaLive\nconst output = new RouterOutput(stack, 'Output', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\nThis gives you a complete pipeline: the encoder pushes SRT to the network interface, the router receives it as an input, and the router output delivers it to MediaLive. For routing rules — including how bitrate affects which outputs can receive which inputs — see the [documentation](https://docs.aws.amazon.com/mediaconnect/latest/ug/using-router-control-panel.html).\n\n### Router Network Interfaces\n\nNetwork interfaces define the network connectivity for router inputs and outputs:\n\n#### Public Network Interface\n\n```ts\ndeclare const stack: Stack;\n\nconst publicInterface = new RouterNetworkInterface(stack, 'PublicInterface', {\n  routerNetworkInterfaceName: 'public-interface',\n  configuration: RouterNetworkConfiguration.publicNetwork({\n    cidr: ['203.0.113.0/24'],\n  }),\n});\n```\n\n#### Private Network Interface\n\n```ts\ndeclare const stack: Stack;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst privateInterface = new RouterNetworkInterface(stack, 'PrivateInterface', {\n  routerNetworkInterfaceName: 'private-interface',\n  configuration: RouterNetworkConfiguration.vpc({\n    securityGroups: [securityGroup],\n    subnet: subnet,\n  }),\n});\n```\n\n### Router Inputs\n\nRouter inputs receive live video streams from various sources and make them available for routing:\n\n#### Standard Input with RTP Protocol\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'RtpInput', {\n  routerInputName: 'rtp-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  // tier defaults to RouterInputTier.INPUT_20 (lowest cost)\n  configuration: RouterInputConfiguration.standard({\n    networkInterface: networkInterface,\n    protocol: RouterInputProtocol.rtp({\n      port: 5000,\n    }),\n  }),\n});\n```\n\n#### Failover Input Configuration\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});\n```\n\n#### MediaLive Channel Input\n\nConnect a router input to a MediaLive channel. The `outputName` must match the name of an output configured in the channel's MediaConnect Router output group.\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\n> **Tip:** For full examples of wiring a MediaLive channel to a MediaConnect Router (including\n> transit encryption), see the [MediaLive L2 README — MediaConnect Router section](./../aws-medialive-alpha/README.md#aws-elemental-mediaconnect-router).\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});\n```\n\nOr prepare a router input for a MediaLive connection without specifying the channel (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst input = new RouterInput(stack, 'ChannelInputNoConnection', {\n  routerInputName: 'channel-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannelWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### MediaConnect Flow Input\n\nConnect a router input to an existing MediaConnect flow:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const flowOutput: FlowOutput;\n\nconst input = new RouterInput(stack, 'FlowInput', {\n  routerInputName: 'flow-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaConnectFlow({\n    flow: flow,\n    flowOutput: flowOutput,\n  }),\n});\n```\n\nOr prepare a router input for a flow connection without specifying the flow (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst input = new RouterInput(stack, 'FlowInputNoConnection', {\n  routerInputName: 'flow-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n### Router Outputs\n\nRouter outputs send video streams to various destinations including standard protocols, MediaLive inputs, and MediaConnect flows:\n\n#### Standard Output with SRT Protocol\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst output = new RouterOutput(stack, 'SrtOutput', {\n  routerOutputName: 'srt-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  // tier defaults to RouterOutputTier.OUTPUT_20 (lowest cost)\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtListener({\n      port: 9001,\n      minimumLatency: Duration.millis(200),\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\n> **Note:** The `tier` property defaults to the lowest (and cheapest) tier: `INPUT_20` for Router Inputs and `OUTPUT_20` for Router Outputs. The construct validates that `maximumBitrate` does not exceed the tier's capacity (20, 50, or 100 Mbps) at synth time. Per the [documentation](https://docs.aws.amazon.com/mediaconnect/latest/ug/using-router-control-panel.html), if an input is 20 Mbps you can't route it to an output set up for less than 20 Mbps.\n\n#### MediaLive Output\n\nConnect a router output to a MediaLive input (the input must be a MediaConnect Router type):\n\n```ts\ndeclare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutput', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});\n```\n\nOr prepare a router output for a MediaLive connection without specifying the input (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutputNoConnection', {\n  routerOutputName: 'medialive-output-no-connection',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInputWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### MediaConnect Flow Output\n\nConnect a router output to an existing MediaConnect flow:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\n\nconst output = new RouterOutput(stack, 'FlowOutput', {\n  routerOutputName: 'flow-output',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaConnectFlow({\n    flow: flow,\n  }),\n});\n```\n\nOr prepare a router output for a flow connection without specifying the flow (requires explicit availability zone):\n\n```ts\ndeclare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'FlowOutputNoConnection', {\n  routerOutputName: 'flow-output-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});\n```\n\n#### Output with Encryption\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\n## Flows\n\nA MediaConnect flow represents a transport stream connection between a source and one or more outputs. Flows are the primary resource for transporting live video content.\n\n### Creating a Flow\n\nThe following example creates a basic MediaConnect flow with an RTP source:\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  flowName: 'my-live-stream',\n  source: SourceConfiguration.rtp({\n    flowSourceName: 'my-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n### Flow Sources\n\nMediaConnect supports multiple source types for ingesting content into a flow. The examples below use `NetworkConfiguration.publicNetwork()` for simplicity, but all protocol-based sources can also use `NetworkConfiguration.vpc()` with a VPC interface for private connectivity.\n\n#### SRT Listener Source\n\nSRT (Secure Reliable Transport) in listener mode configures MediaConnect to listen on a specific port for incoming content. The upstream device connects to MediaConnect as a caller.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtListener({\n    flowSourceName: 'live-encoder-source',\n    description: 'Live encoder feed',\n    port: 5000,\n    minLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### SRT Caller Source\n\nSRT in caller mode configures MediaConnect to connect to a remote SRT listener. Use this when the source device is listening for incoming connections rather than pushing content.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtCaller({\n    flowSourceName: 'remote-source',\n    sourceListenerAddress: '203.0.113.50',\n    sourceListenerPort: 5000,\n    minLatency: Duration.millis(200),\n  }),\n});\n```\n\n#### RTP Source\n\nRTP (Real-time Transport Protocol) is a standard protocol for delivering audio and video over IP networks.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rtp({\n    flowSourceName: 'rtp-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### RTP-FEC Source\n\nRTP with Forward Error Correction adds redundancy to recover lost packets without retransmission. Use this when contributing via RTP and you need packet recovery.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rtpFec({\n    flowSourceName: 'rtp-fec-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### RIST Source\n\nRIST (Reliable Internet Stream Transport) provides reliable video transport with packet recovery.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rist({\n    flowSourceName: 'rist-source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n#### Zixi Push Source\n\nZixi Push uses the Zixi protocol for reliable video transport. Content is pushed to MediaConnect from a Zixi-compatible component upstream.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.zixiPush({\n    flowSourceName: 'zixi-source',\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n  }),\n});\n```\n\n> Zixi Push ports are assigned by MediaConnect: 2088 for public sources, 2090-2099 for VPC sources. See [Source port assignments](https://docs.aws.amazon.com/mediaconnect/latest/ug/source-ports.html).\n\n#### Router Source\n\nUse a router source when the flow's source comes from a MediaConnect Router rather than a direct connection.\n\n```ts\ndeclare const stack: Stack;\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.router(),\n});\n```\n\n#### VPC Source\n\nUse a VPC-based source when you need a connection between a flow and your Amazon VPC. This enables private connectivity for receiving content from on-premises equipment via AWS Direct Connect or VPN, or from other AWS services running in your VPC.\n\n```ts\ndeclare const stack: Stack;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\ndeclare const role: iam.IRole;\n\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'my-vpc-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n});\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.rist({\n    flowSourceName: 'vpc-source',\n    description: 'VPC-based source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.vpc(vpcInterface),\n  }),\n  vpcInterfaces: [vpcInterface],\n});\n```\n\n#### Entitled Source (From Another AWS Account)\n\nEntitlements allow you to subscribe to content from another AWS account. The entitlement is created by the content originator in their AWS account, and you import it using the entitlement ARN they provide.\n\n```ts\ndeclare const stack: Stack;\n\n// Import an entitlement from another AWS account\nconst entitlement = FlowEntitlement.fromFlowEntitlementArn(stack, 'ImportedEntitlement',\n  'arn:aws:mediaconnect:us-west-2:111122223333:entitlement:1-11111111111111111111111111111111:MyEntitlement',\n);\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.entitlement({\n    entitlement: entitlement,\n  }),\n});\n```\n\n#### Gateway Bridge Source\n\nUse a gateway bridge source when ingesting content from on-premises equipment through a MediaConnect gateway and bridge. Gateways define the network infrastructure that bridges use to transport video between on-premises and cloud environments.\n\n```ts\ndeclare const stack: Stack;\ndeclare const bridge: Bridge;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'bridge-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n});\n\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.gatewayBridge({\n    bridge: bridge,\n    vpcInterface: vpcInterface,\n  }),\n  vpcInterfaces: [vpcInterface],\n});\n```\n\n### VPC Interfaces\n\nVPC interfaces allow MediaConnect to send or receive content within your VPC. Create VPC interfaces using `VpcInterface.define()` and add them to the flow's `vpcInterfaces` array. The same interface can then be referenced in sources and outputs:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\n// Create VPC interface\nconst vpcInterface = VpcInterface.define({\n  vpcInterfaceName: 'my-vpc-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.ENA,\n});\n\n// Add to flow and reference in source\nconst flow = new Flow(stack, 'MyFlow', {\n  vpcInterfaces: [vpcInterface],  // Declare at flow level\n  source: SourceConfiguration.rist({\n    flowSourceName: 'vpc-source',\n    port: 5000,\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.vpc(vpcInterface),  // Reference in source\n  }),\n});\n```\n\n#### CDI and JPEG XS with EFA Interfaces\n\nFor high-performance CDI or JPEG XS workflows, use EFA (Elastic Fabric Adapter) interfaces. Note that flows can have a maximum of 1 EFA interface:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const securityGroup: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst efaInterface = VpcInterface.define({\n  vpcInterfaceName: 'efa-interface',\n  role: role,\n  securityGroups: [securityGroup],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.EFA,  // Required for CDI\n});\n\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video',\n  videoFormat: MediaVideoFormat.HD_1080P,\n  fmtp: {\n    exactFramerate: Framerate.FPS_29_97,\n    par: PixelAspectRatio.SQUARE,\n  },\n});\n\nconst flow = new Flow(stack, 'MyCdiFlow', {\n  flowSize: FlowSize.LARGE_4X,  // Required for CDI and JPEG XS\n  vpcInterfaces: [efaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.cdi({\n    flowSourceName: 'cdi-source',\n    vpcInterface: efaInterface,\n    port: 5000,\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.RAW,\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\n#### JPEG XS with Redundant Interfaces\n\nJPEG XS requires exactly 2 input interfaces per media stream for redundancy. Typically one EFA and one ENA interface:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const sg1: ec2.ISecurityGroup;\ndeclare const sg2: ec2.ISecurityGroup;\ndeclare const subnet: ec2.ISubnet;\n\nconst efaInterface = VpcInterface.define({\n  vpcInterfaceName: 'efa-interface',\n  role: role,\n  securityGroups: [sg1],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.EFA,\n});\n\nconst enaInterface = VpcInterface.define({\n  vpcInterfaceName: 'ena-interface',\n  role: role,\n  securityGroups: [sg2],\n  subnet: subnet,\n  networkInterfaceType: NetworkInterface.ENA,\n});\n\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video',\n  videoFormat: MediaVideoFormat.UHD_2160P,\n  fmtp: {\n    exactFramerate: Framerate.FPS_59_94,\n    par: PixelAspectRatio.SQUARE,\n    colorimetry: Colorimetry.BT2020,\n    videoRange: VideoRange.FULL,\n    scanMode: ScanMode.PROGRESSIVE,\n    tcs: Tcs.PQ,\n  },\n});\n\nconst flow = new Flow(stack, 'MyJpegXsFlow', {\n  flowSize: FlowSize.LARGE_4X,  // Required for JPEG XS\n  vpcInterfaces: [efaInterface, enaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.jpegXs({\n    flowSourceName: 'jpegxs-source',\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.JXSV,\n      port: 5000,\n      inputInterface: [efaInterface, enaInterface],  // 2 interfaces for redundancy\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\n### Media Streams\n\nMedia streams represent individual components of your content (video, audio, ancillary data) for ST 2110 JPEG XS or CDI workflows. Create media streams using the static factory methods and add them to the flow's `mediaStreams` array:\n\n```ts\ndeclare const stack: Stack;\n\n// Create media streams\nconst videoStream = MediaStream.video({\n  mediaStreamId: 1,\n  mediaStreamName: 'video-stream',\n  videoFormat: MediaVideoFormat.HD_1080P,\n  fmtp: {\n    colorimetry: Colorimetry.BT709,\n    exactFramerate: Framerate.FPS_29_97,\n    par: PixelAspectRatio.SQUARE,\n    videoRange: VideoRange.NARROW,\n    scanMode: ScanMode.PROGRESSIVE,\n    tcs: Tcs.SDR,\n  },\n});\n\nconst audioStream = MediaStream.audio({\n  mediaStreamId: 2,\n  mediaStreamName: 'audio-stream',\n  channelOrder: AudioStreamOrderOptions.STANDARD_STEREO,\n});\n\n// Add to flow\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.router(),\n  mediaStreams: [videoStream, audioStream],  // Declare at flow level\n});\n```\n\n#### Audio Channel Order\n\nFor audio media streams, use the `AudioStreamOrderOptions` enum to specify the SMPTE 2110-30 channel order:\n\n```ts\n// Available channel order options\nAudioStreamOrderOptions.MONO                    // SMPTE2110.(M)\nAudioStreamOrderOptions.DUAL_MONO               // SMPTE2110.(DM)\nAudioStreamOrderOptions.STANDARD_STEREO         // SMPTE2110.(ST)\nAudioStreamOrderOptions.LTRT_MATRIX_STEREO      // SMPTE2110.(LtRt)\nAudioStreamOrderOptions.SURROUND_5_1            // SMPTE2110.(51)\nAudioStreamOrderOptions.SURROUND_7_1            // SMPTE2110.(71)\nAudioStreamOrderOptions.SURROUND_22_2           // SMPTE2110.(222)\nAudioStreamOrderOptions.ONE_SDI_AUDIO_GROUP     // SMPTE2110.(SGRP)\n\n// Example with 5.1 surround\nconst surroundAudio = MediaStream.audio({\n  mediaStreamId: 3,\n  mediaStreamName: 'surround-audio',\n  channelOrder: AudioStreamOrderOptions.SURROUND_5_1,\n});\n```\n\nMedia streams can be referenced in source configurations (for CDI and JPEG XS) and output configurations.\n\n### Flow Sizes\n\nMediaConnect offers three flow sizes that determine feature support:\n\n| Flow Size | Transport Streams | NDI | CDI / JPEG XS |\n|-----------|------------------|-----|---------------|\n| `MEDIUM` (default) | ✅ | ❌ | ❌ |\n| `LARGE` | ✅ | ✅ | ❌ |\n| `LARGE_4X` | ❌ | ❌ | ✅ |\n\nThis table maps each `FlowSize` to the capabilities the construct validates. For output counts, throughput limits, and other per-size details, see [Flow sizes and capabilities](https://docs.aws.amazon.com/mediaconnect/latest/ug/flow-sizes-capabilities.html).\n\nThe construct validates flow size constraints at synthesis time based on the source protocol and NDI configuration:\n\n- `MEDIUM` supports transport stream protocols (RTP, SRT, RIST, etc.) but not NDI or CDI\n- `LARGE` supports transport streams and NDI, and is required when NDI is enabled\n- `LARGE_4X` is required for CDI and JPEG XS protocols, and does not support transport streams or NDI\n\nThese are mutually exclusive — CDI/JPEG XS and NDI cannot coexist on the same flow because they require different flow sizes.\n\n```ts\ndeclare const stack: Stack;\ndeclare const ndiVpcInterface: VpcInterfaceConfig;\ndeclare const efaInterface: VpcInterfaceConfig;\ndeclare const videoStream: MediaStream;\n\n// NDI requires LARGE, an encoding profile, and at least one discovery server\nnew Flow(stack, 'NdiFlow', {\n  flowSize: FlowSize.LARGE,\n  ndiConfig: {\n    ndiState: State.ENABLED,\n    ndiDiscoveryServers: [{\n      discoveryServerAddress: '10.0.0.10',\n      vpcInterface: ndiVpcInterface,\n    }],\n  },\n  encodingConfig: {\n    encodingProfile: EncodingProfile.CONTRIBUTION_H264_DEFAULT,\n  },\n  source: SourceConfiguration.ndi({\n    flowSourceName: 'ndi-source',\n  }),\n});\n\n// CDI and JPEG XS require LARGE_4X\nnew Flow(stack, 'CdiFlow', {\n  flowSize: FlowSize.LARGE_4X,\n  vpcInterfaces: [efaInterface],\n  mediaStreams: [videoStream],\n  source: SourceConfiguration.cdi({\n    flowSourceName: 'cdi-source',\n    vpcInterface: efaInterface,\n    port: 5000,\n    maxSyncBuffer: 100,\n    mediaStreamSourceConfigurations: [{\n      encoding: Encoding.RAW,\n      mediaStream: videoStream,\n    }],\n  }),\n});\n```\n\nFor more information, see [Flow sizes and capabilities](https://docs.aws.amazon.com/mediaconnect/latest/ug/flow-sizes-capabilities.html).\n\n## Gateways\n\nMediaConnect Gateways enable the deployment of on-premises resources for transporting live video to and from the AWS Cloud. Gateways are required for creating bridges.\n\n### Creating a Gateway\n\n```ts\ndeclare const stack: Stack;\n\nconst productionNetwork = GatewayNetwork.define({\n  cidrBlock: '192.168.1.0/24',\n  name: 'production-network',\n});\n\nconst gateway = new Gateway(stack, 'MyGateway', {\n  gatewayName: 'my-gateway',\n  egressCidrBlocks: ['10.0.0.0/16'],\n  networks: [productionNetwork],\n});\n```\n\n### Importing an Existing Gateway\n\n```ts\ndeclare const stack: Stack;\n\nconst gateway = Gateway.fromGatewayArn(stack, 'ImportedGateway',\n  'arn:aws:mediaconnect:us-west-2:123456789012:gateway:1-XXXXXX',\n);\n```\n\n## Bridges\n\nMediaConnect bridges enable you to interconnect on-premises equipment with cloud-based workflows. Bridges support both ingress (on-premises to cloud) and egress (cloud to on-premises) scenarios.\n\n### Creating a Bridge\n\n#### Ingress Bridge (On-premises to Cloud)\n\nAn ingress bridge receives content from on-premises equipment and makes it available in the cloud:\n\n```ts\ndeclare const stack: Stack;\n\nconst productionNetwork = GatewayNetwork.define({\n  cidrBlock: '192.168.1.0/24',\n  name: 'production-network',\n});\n\nconst gateway = new Gateway(stack, 'MyGateway', {\n  gatewayName: 'my-gateway',\n  egressCidrBlocks: ['10.0.0.0/16'],\n  networks: [productionNetwork],\n});\n\nconst ingressBridge = new Bridge(stack, 'MyIngressBridge', {\n  bridgeName: 'my-ingress-bridge',\n  config: BridgeConfiguration.ingress({\n    maxBitrate: Bitrate.mbps(10),\n    maxOutputs: 2,\n    networkSources: [{\n      name: 'on-prem-source',\n      source: {\n        protocol: BridgeProtocol.RTP,\n        network: productionNetwork,\n        multicastIp: '239.1.1.1',\n        port: 5000,\n      },\n    }],\n  }),\n  gateway: gateway,\n});\n```\n\n#### Egress Bridge (Cloud to On-premises)\n\nAn egress bridge sends content from MediaConnect flows to on-premises equipment:\n\n```ts\ndeclare const stack: Stack;\ndeclare const gateway: Gateway;\ndeclare const flow: Flow;\ndeclare const vpcInterface: VpcInterfaceConfig;\ndeclare const productionNetwork: GatewayNetwork;\n\nconst egressBridge = new Bridge(stack, 'MyEgressBridge', {\n  bridgeName: 'my-egress-bridge',\n  config: BridgeConfiguration.egress({\n    maxBitrate: Bitrate.mbps(10),\n    flowSources: [{\n      name: 'cloud-source',\n      source: {\n        flow: flow,\n        vpcInterface: vpcInterface,\n      },\n    }],\n    networkOutputs: [{\n      name: 'on-prem-output',\n      output: BridgeOutputConfiguration.network({\n        ipAddress: '192.168.1.200',\n        port: 5001,\n        network: productionNetwork,\n        protocol: BridgeProtocol.RTP,\n        ttl: 50,\n      }),\n    }],\n  }),\n  gateway: gateway,\n});\n```\n\n### Bridge Sources\n\nFor failover scenarios, you can add additional sources to an existing bridge using the `BridgeSource` construct:\n\n```ts\ndeclare const stack: Stack;\ndeclare const bridge: Bridge;\ndeclare const flow: Flow;\n\n// Add a flow source to an egress bridge (requires failover to be enabled)\nconst additionalSource = new BridgeSource(stack, 'AdditionalSource', {\n  bridgeSourceName: 'backup-source',\n  bridge: bridge,\n  source: BridgeSourceConfiguration.flow({\n    flow: flow,\n  }),\n});\n```\n\n### Bridge Outputs\n\nBridge outputs are configured as part of the bridge configuration for egress bridges. They define where content exits the bridge to on-premises equipment.\n\n```ts\ndeclare const productionNetwork: GatewayNetwork;\n\nconst networkConfig = BridgeOutputConfiguration.network({\n  ipAddress: '192.168.1.200',\n  port: 5001,\n  network: productionNetwork,\n  protocol: BridgeProtocol.RTP,\n  ttl: 50,\n});\n\nconst namedOutput = { name: 'on-prem-output', output: networkConfig };\n```\n\n## Encryption\n\nMediaConnect supports encryption for sources, outputs, and entitlements. This package provides type-safe encryption configuration structs that match the encryption requirements for different protocols.\n\n### Encryption Types\n\nMediaConnect supports two types of encryption:\n\n1. **Static Key Encryption** - Used for Zixi Push/Pull protocols and entitlements\n2. **SRT Password Encryption** - Used for SRT Listener and SRT Caller protocols\n\nNote: CFN exposes only `static-key` and `srt-password` for flow output encryption today; SPEKE is not currently part of the surface.\n\n**Auto-created IAM role.** Every encryption struct accepts an optional `role`. Omit it and the consuming construct creates a scoped role for you: trust policy for `mediaconnect.amazonaws.com` with `aws:SourceAccount` + `aws:SourceArn` conditions (confused-deputy protection), and just enough permission to read the provided secret (including `kms:Decrypt` when the secret uses a customer-managed KMS key).\n\n**Providing your own role.** If you supply a `role`, it's used as-is — the construct does **not** grant it any permissions. You must grant it the necessary permissions yourself. Provide your own role when you need stricter control or a shared identity.\n\n**Trust-policy scope: flows vs. routers.** When the L2 auto-creates a role, it also pins `aws:SourceArn` to the consuming resource:\n\n- **Flows** — the trust policy pins the flow ARN (`arn:...:flow:*:<flow-name>`). The `*` wildcards the service-assigned id segment; the flow name is fixed at create time.\n- **Routers** — the trust policy can only pin a wildcarded ARN (`arn:...:routerInput:*` / `arn:...:routerOutput:*`). Router I/O ARNs use a service-generated id segment that is unknown at synth time, and using the live ARN attribute would create a CloudFormation dependency cycle (role → router → role). If you need per-resource pinning, supply your own `role` with a trust condition that pins the exact ARN — you can compute it from the resource's `routerInputId` / `routerOutputId` after first deploy and apply it on a follow-up deploy.\n\n### Static Key Encryption\n\nUse a static-key encryption struct for Zixi protocols and entitlements. This requires an encryption algorithm (AES128, AES192, or AES256). Pass it inline where the construct asks for it:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nnew FlowEntitlement(stack, 'MyEntitlement', {\n  flow,\n  subscribers: ['111122223333'],\n  description: 'Grant partner access to live feed',\n  encryption: {\n    role,\n    secret,\n    algorithm: EncryptionAlgorithm.AES256,\n  },\n});\n```\n\n### SRT Password Encryption\n\nSRT protocols take an encryption struct with just `role` and `secret` — no algorithm:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nnew FlowOutput(stack, 'SrtOutput', {\n  flow,\n  output: OutputConfiguration.srtCaller({\n    destination: '203.0.113.100',\n    port: 7000,\n    encryption: { role, secret },\n  }),\n});\n```\n\n### Using Encryption with Sources\n\nApply encryption when configuring flow sources:\n\n```ts\ndeclare const stack: Stack;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\n// SRT Listener source with encryption\nconst flow = new Flow(stack, 'MyFlow', {\n  source: SourceConfiguration.srtListener({\n    flowSourceName: 'encrypted-source',\n    port: 5000,\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n    decryption: { role, secret },\n  }),\n});\n\n// Zixi Push source with encryption\nconst flow2 = new Flow(stack, 'MyFlow2', {\n  source: SourceConfiguration.zixiPush({\n    flowSourceName: 'encrypted-zixi-source',\n    maxLatency: Duration.millis(2000),\n    network: NetworkConfiguration.publicNetwork('203.0.113.0/24'),\n    decryption: {\n      role,\n      secret,\n      algorithm: EncryptionAlgorithm.AES256,\n    },\n  }),\n});\n```\n\n### Using Encryption with Outputs\n\nApply encryption when configuring flow outputs:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\n// SRT Caller output with encryption\nconst output = new FlowOutput(stack, 'EncryptedOutput', {\n  flow: flow,\n  description: 'Encrypted SRT output',\n  output: OutputConfiguration.srtCaller({\n    destination: '203.0.113.100',\n    port: 7000,\n    encryption: { role, secret },\n  }),\n});\n```\n\n### Using Encryption with Entitlements\n\nEntitlements use static key encryption:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst entitlement = new FlowEntitlement(stack, 'MyEntitlement', {\n  flow: flow,\n  description: 'Grant partner access to live feed',\n  subscribers: ['111122223333'],\n  encryption: {\n    role,\n    secret,\n    algorithm: EncryptionAlgorithm.AES256,\n  },\n});\n```\n\n### Router Transit Encryption\n\nWhen integrating flows with routers, use transit encryption to secure the connection between the flow and router:\n\n```ts\ndeclare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\ndeclare const existingRouterOutput: RouterOutput;\n\n// Flow output to router with transit encryption\nconst routerOutput = new FlowOutput(stack, 'RouterOutput', {\n  flow: flow,\n  output: OutputConfiguration.router({\n    encryption: { role, secret },\n  }),\n});\n\n// Flow source from router with transit encryption\nconst flowFromRouter = new Flow(stack, 'FlowFromRouter', {\n  source: SourceConfiguration.router({\n    routerOutput: existingRouterOutput,\n    decryption: { role, secret },\n  }),\n});\n```\n\n### Router SRT Encryption\n\nRouter outputs using SRT protocols use `RouterSrtEncryption` for encryption:\n\n```ts\ndeclare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedSrtOutput', {\n  routerOutputName: 'encrypted-srt-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});\n```\n\nNote: `RouterSrtEncryption` is distinct from `SrtPasswordEncryption` (used on flow sources/outputs) — router outputs use a simpler CFN shape without a `keyType` discriminator.\n\n## CloudWatch Metrics\n\nFlows and Bridges expose CloudWatch metric helpers for monitoring. You can create alarms and dashboards using these metrics:\n\n```ts\ndeclare const flow: Flow;\ndeclare const stack: Stack;\n\n// Create a CloudWatch alarm on source bitrate\nconst alarm = flow.metricSourceBitrate().createAlarm(stack, 'LowBitrate', {\n  threshold: 1000000,\n  evaluationPeriods: 1,\n});\n\n// Monitor unrecovered packets\nflow.metricSourceNotRecoveredPackets().createAlarm(stack, 'PacketLoss', {\n  threshold: 100,\n  evaluationPeriods: 2,\n});\n\n// Track total packets with custom options\nconst totalPackets = flow.metricSourceTotalPackets({\n  statistic: 'sum',\n  period: Duration.minutes(5),\n});\n```\n\n### Flow metrics\n\n- `metricSourceBitrate()` - Bitrate of content ingested into the flow (average)\n- `metricSourceNotRecoveredPackets()` - Packets lost in transit that were not recovered by error correction (sum)\n- `metricSourceTotalPackets()` - Total packets received by the flow sources (sum)\n- `metricSourceSelected()` - Indicates which source is being used under Failover mode (max; 1 = active, 0 = standby)\n- `metricSourceConnected()` - Source connection state for Zixi, SRT, and RIST (min; 1 = connected, 0 = disconnected)\n- `metricSourceDisconnections()` - Number of times the source transitioned from connected to disconnected (sum)\n- `metricSourceDroppedPackets()` - Packets lost before any error correction took place (sum)\n- `metricSourcePacketLossPercent()` - Percentage of packets lost during transit, even if they were recovered (average)\n- `metricSourceRoundTripTime()` - Round-trip time to the source for RIST, Zixi, and SRT (average, milliseconds)\n- `metricSourceJitter()` - Current network jitter of the source (average, milliseconds)\n- `metric(metricName)` - Create a custom metric by name\n\n### Bridge metrics\n\nBridge metrics are dimensioned by `BridgeARN`. The underlying CloudWatch metric name is chosen automatically based on whether the bridge is ingress or egress.\n\n- `metricSourceBitrate(bridgeSourceName)` - Bitrate of a specific bridge source (average)\n- `metricSourcePacketLossPercent(bridgeSourceName)` - Percentage of packets lost on a specific bridge source (average)\n- `metricFailoverSwitches()` - Total number of times the bridge switches between sources under `FAILOVER` failover mode (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Router Input metrics\n\nRouter input metrics are dimensioned by `RouterInputARN`.\n\n- `metricBitrate()` - Bitrate of the router input's payload (average)\n- `metricNotRecoveredPackets()` - Packets lost in transit that were not recovered by error correction (sum)\n- `metricTotalPackets()` - Total number of packets received by the router input (sum)\n- `metricConnected()` - Connection state for SRT sources (min; 1 = connected, 0 = disconnected)\n- `metricContinuityCounterErrors()` - Continuity counter errors in the transport stream (sum)\n- `metricLatency()` - Recovery latency of the input stream for RIST, SRT, and RTP-FEC (average, milliseconds)\n- `metricFailoverSwitches()` - Total times the router input switched sources under Failover mode (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Router Output metrics\n\nRouter output metrics are dimensioned by `RouterOutputARN`.\n\n- `metricBitrate()` - Bitrate of the router output's payload (average)\n- `metricTotalPackets()` - Total number of packets sent by the router output (sum)\n- `metricConnected()` - Connection state for SRT outputs (min; 1 = connected, 0 = disconnected)\n- `metricArqRequests()` - Retransmitted packets requested through ARQ for RIST and SRT outputs (sum)\n- `metric(metricName)` - Create a custom metric by name\n\n### Gateway metrics\n\nGateway metrics are dimensioned by `GatewayARN`. Pass extra dimensions such as `NetworkName`, `InstanceId`, or `BridgeSourceName` via `props.dimensionsMap` to narrow to a specific network, appliance, or bridge source.\n\n- `metricEgressBridgeTotalPackets()` - Total packets sent from egress bridges hosted on the gateway (sum)\n- `metricEgressBridgeDroppedPackets()` - Packets dropped by egress bridges hosted on the gateway (sum)\n- `metricIngressBridgeTotalPackets()` - Total packets received by ingress bridges hosted on the gateway (sum)\n- `metricIngressBridgeDroppedPackets()` - Packets dropped by ingress bridges hosted on the gateway (sum)\n- `metric(metricName)` - Create a custom metric by name (e.g. `IngressBridgeBitRate`, `EgressBridgeBitRate`, `IngressBridgeSourcePacketLossPercent`)\n\nPair the total + dropped helpers to build a dropped-packet percentage chart — for example, divide `metricEgressBridgeDroppedPackets()` by `metricEgressBridgeTotalPackets()` in a math expression.\n\nAll metrics support standard CloudWatch metric options for customizing period, statistic, and dimensions.\n\n## Public CIDR warnings\n\nSeveral constructs accept CIDR ranges that determine who can contribute content or pull outputs. Passing an open range (`0.0.0.0/0` or any `/0` prefix) makes the resource reachable from anywhere on the public internet, which is rarely what you want. The module emits synthesis-time warnings when it detects an open range on:\n\n- `GatewayProps.egressCidrBlocks`\n- `NetworkConfiguration.publicNetwork(cidr)` used on flow sources\n- `cidrAllowList` on Zixi Push / Zixi Pull / SRT Listener flow outputs\n- `RouterNetworkConfiguration.publicNetwork({ cidr })`\n\nRestrict each range to the narrowest set of addresses that actually need access.\n"
   },
   "repository": {
     "directory": "packages/@aws-cdk/aws-mediaconnect-alpha",
@@ -12780,7 +12780,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for failover Router Input configuration.",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -12789,7 +12789,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 725
+        "line": 727
       },
       "name": "FailoverConfigurationProps",
       "properties": [
@@ -12802,7 +12802,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 727
+            "line": 729
           },
           "name": "networkInterface",
           "type": {
@@ -12818,7 +12818,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 729
+            "line": 731
           },
           "name": "protocols",
           "type": {
@@ -12840,7 +12840,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 741
+            "line": 743
           },
           "name": "availabilityZone",
           "optional": true,
@@ -12858,7 +12858,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 735
+            "line": 737
           },
           "name": "sourcePriority",
           "optional": true,
@@ -15478,7 +15478,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 331
+        "line": 333
       },
       "members": [
         {
@@ -18116,7 +18116,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 80
+        "line": 81
       },
       "methods": [
         {
@@ -18128,7 +18128,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 130
+            "line": 131
           },
           "name": "metric",
           "parameters": [
@@ -18162,7 +18162,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 156
+            "line": 157
           },
           "name": "metricArqRequests",
           "parameters": [
@@ -18189,7 +18189,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 136
+            "line": 137
           },
           "name": "metricBitrate",
           "parameters": [
@@ -18217,7 +18217,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 148
+            "line": 149
           },
           "name": "metricConnected",
           "parameters": [
@@ -18244,7 +18244,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 142
+            "line": 143
           },
           "name": "metricTotalPackets",
           "parameters": [
@@ -18277,7 +18277,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 107
+            "line": 108
           },
           "name": "ipAddress",
           "type": {
@@ -18296,7 +18296,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 93
+            "line": 94
           },
           "name": "routerOutputArn",
           "type": {
@@ -18315,7 +18315,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 100
+            "line": 101
           },
           "name": "routerOutputId",
           "type": {
@@ -18334,7 +18334,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 86
+            "line": 87
           },
           "name": "routerOutputName",
           "type": {
@@ -18353,7 +18353,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 114
+            "line": 115
           },
           "name": "createdAt",
           "optional": true,
@@ -18373,7 +18373,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 121
+            "line": 122
           },
           "name": "updatedAt",
           "optional": true,
@@ -18590,7 +18590,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 251
+        "line": 252
       },
       "name": "MaintenanceConfiguration",
       "properties": [
@@ -18603,7 +18603,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 253
+            "line": 254
           },
           "name": "day",
           "type": {
@@ -18619,7 +18619,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 255
+            "line": 256
           },
           "name": "time",
           "type": {
@@ -18757,7 +18757,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for MediaConnect Flow Router Input configuration.",
-        "example": "declare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const flowOutput: FlowOutput;\n\nconst input = new RouterInput(stack, 'FlowInput', {\n  routerInputName: 'flow-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaConnectFlow({\n    flow: flow,\n    flowOutput: flowOutput,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const flow: Flow;\ndeclare const flowOutput: FlowOutput;\n\nconst input = new RouterInput(stack, 'FlowInput', {\n  routerInputName: 'flow-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaConnectFlow({\n    flow: flow,\n    flowOutput: flowOutput,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -18766,7 +18766,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 765
+        "line": 767
       },
       "name": "MediaConnectFlowConfigurationProps",
       "properties": [
@@ -18779,7 +18779,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 767
+            "line": 769
           },
           "name": "flow",
           "type": {
@@ -18795,7 +18795,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 769
+            "line": 771
           },
           "name": "flowOutput",
           "type": {
@@ -18812,7 +18812,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 774
+            "line": 776
           },
           "name": "sourceTransitDecryption",
           "optional": true,
@@ -18829,7 +18829,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for MediaConnect Flow Router Input configuration - without a connection.",
-        "example": "declare const stack: Stack;\n\nconst input = new RouterInput(stack, 'FlowInputNoConnection', {\n  routerInputName: 'flow-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
+        "example": "declare const stack: Stack;\n\nconst input = new RouterInput(stack, 'FlowInputNoConnection', {\n  routerInputName: 'flow-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -18838,7 +18838,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 780
+        "line": 782
       },
       "name": "MediaConnectFlowConfigurationWithoutConnectionProps",
       "properties": [
@@ -18851,7 +18851,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 784
+            "line": 786
           },
           "name": "availabilityZone",
           "type": {
@@ -18868,7 +18868,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 789
+            "line": 791
           },
           "name": "sourceTransitDecryption",
           "optional": true,
@@ -18885,7 +18885,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for MediaConnect Flow Router Output configuration with specific flow connection.",
-        "example": "declare const stack: Stack;\ndeclare const flow: Flow;\n\nconst output = new RouterOutput(stack, 'FlowOutput', {\n  routerOutputName: 'flow-output',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_100,\n  configuration: RouterOutputConfiguration.mediaConnectFlow({\n    flow: flow,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const flow: Flow;\n\nconst output = new RouterOutput(stack, 'FlowOutput', {\n  routerOutputName: 'flow-output',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaConnectFlow({\n    flow: flow,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -18894,7 +18894,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 508
+        "line": 510
       },
       "name": "MediaConnectFlowConnectionProps",
       "properties": [
@@ -18907,7 +18907,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 510
+            "line": 512
           },
           "name": "flow",
           "type": {
@@ -18924,7 +18924,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 515
+            "line": 517
           },
           "name": "destinationTransitEncryption",
           "optional": true,
@@ -18941,7 +18941,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for MediaConnect Flow Router Output configuration without specific flow connection.",
-        "example": "declare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'FlowOutputNoConnection', {\n  routerOutputName: 'flow-output-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_100,\n  configuration: RouterOutputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
+        "example": "declare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'FlowOutputNoConnection', {\n  routerOutputName: 'flow-output-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaConnectFlowWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -18950,7 +18950,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 521
+        "line": 523
       },
       "name": "MediaConnectFlowNoConnectionProps",
       "properties": [
@@ -18963,7 +18963,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 523
+            "line": 525
           },
           "name": "availabilityZone",
           "type": {
@@ -18980,7 +18980,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 528
+            "line": 530
           },
           "name": "destinationTransitEncryption",
           "optional": true,
@@ -18998,7 +18998,7 @@
         "remarks": "Use this when the MediaLive channel already exists and you want to ingest\nfrom one of its outputs immediately.",
         "stability": "experimental",
         "summary": "Properties for MediaLive Channel Router Input configuration.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -19007,7 +19007,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 798
+        "line": 800
       },
       "name": "MediaLiveChannelConfigurationProps",
       "properties": [
@@ -19020,7 +19020,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 802
+            "line": 804
           },
           "name": "channel",
           "type": {
@@ -19036,7 +19036,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 808
+            "line": 810
           },
           "name": "outputName",
           "type": {
@@ -19052,7 +19052,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 813
+            "line": 815
           },
           "name": "pipeline",
           "type": {
@@ -19070,7 +19070,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 821
+            "line": 823
           },
           "name": "sourceTransitDecryption",
           "optional": true,
@@ -19088,7 +19088,7 @@
         "remarks": "Use this when you want to set up the router input before the target MediaLive channel exists.",
         "stability": "experimental",
         "summary": "Properties for MediaLive Channel Router Input configuration without a specific channel connection.",
-        "example": "declare const stack: Stack;\n\nconst input = new RouterInput(stack, 'ChannelInputNoConnection', {\n  routerInputName: 'channel-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannelWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
+        "example": "declare const stack: Stack;\n\nconst input = new RouterInput(stack, 'ChannelInputNoConnection', {\n  routerInputName: 'channel-input-no-connection',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannelWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -19097,7 +19097,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 829
+        "line": 831
       },
       "name": "MediaLiveChannelConfigurationWithoutConnectionProps",
       "properties": [
@@ -19110,7 +19110,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 833
+            "line": 835
           },
           "name": "availabilityZone",
           "type": {
@@ -19127,7 +19127,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 840
+            "line": 842
           },
           "name": "sourceTransitDecryption",
           "optional": true,
@@ -19153,7 +19153,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 478
+        "line": 480
       },
       "name": "MediaLiveInputConnectionProps",
       "properties": [
@@ -19166,7 +19166,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 482
+            "line": 484
           },
           "name": "input",
           "type": {
@@ -19182,7 +19182,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 484
+            "line": 486
           },
           "name": "pipeline",
           "type": {
@@ -19199,7 +19199,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 489
+            "line": 491
           },
           "name": "destinationTransitEncryption",
           "optional": true,
@@ -19216,7 +19216,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for MediaLive Router Output configuration without specific input connection.",
-        "example": "declare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutputNoConnection', {\n  routerOutputName: 'medialive-output-no-connection',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.mediaLiveInputWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
+        "example": "declare const stack: Stack;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutputNoConnection', {\n  routerOutputName: 'medialive-output-no-connection',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInputWithoutConnection({\n    availabilityZone: 'us-east-1a',\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -19225,7 +19225,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 495
+        "line": 497
       },
       "name": "MediaLiveNoInputConnectionProps",
       "properties": [
@@ -19238,7 +19238,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 497
+            "line": 499
           },
           "name": "availabilityZone",
           "type": {
@@ -19255,7 +19255,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 502
+            "line": 504
           },
           "name": "destinationTransitEncryption",
           "optional": true,
@@ -19271,7 +19271,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "MediaLive pipeline options.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -20015,7 +20015,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 747
+        "line": 749
       },
       "name": "MergeConfigurationProps",
       "properties": [
@@ -20028,7 +20028,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 753
+            "line": 755
           },
           "name": "mergeRecoveryWindow",
           "type": {
@@ -20044,7 +20044,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 749
+            "line": 751
           },
           "name": "networkInterface",
           "type": {
@@ -20060,7 +20060,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 751
+            "line": 753
           },
           "name": "protocols",
           "type": {
@@ -20082,7 +20082,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 759
+            "line": 761
           },
           "name": "availabilityZone",
           "optional": true,
@@ -20995,7 +20995,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Identifies which protocol in a failover configuration's protocols array is primary.",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -21004,7 +21004,7 @@
       "kind": "enum",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 341
+        "line": 343
       },
       "members": [
         {
@@ -21108,7 +21108,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 242
+        "line": 244
       },
       "name": "RistOutputProtocolProps",
       "properties": [
@@ -21121,7 +21121,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 244
+            "line": 246
           },
           "name": "destinationAddress",
           "type": {
@@ -21137,7 +21137,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 246
+            "line": 248
           },
           "name": "port",
           "type": {
@@ -21153,7 +21153,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for RIST protocol configuration.",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -21162,7 +21162,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 410
+        "line": 412
       },
       "name": "RistProtocolProps",
       "properties": [
@@ -21175,7 +21175,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 412
+            "line": 414
           },
           "name": "port",
           "type": {
@@ -21191,7 +21191,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 414
+            "line": 416
           },
           "name": "recoveryLatency",
           "type": {
@@ -21207,7 +21207,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Defines an AWS Elemental MediaConnect Router Input.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -21219,7 +21219,7 @@
         },
         "locationInModule": {
           "filename": "lib/router-input.ts",
-          "line": 1380
+          "line": 1382
         },
         "parameters": [
           {
@@ -21248,7 +21248,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 1282
+        "line": 1284
       },
       "methods": [
         {
@@ -21260,7 +21260,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1298
+            "line": 1300
           },
           "name": "fromRouterInputArn",
           "parameters": [
@@ -21308,7 +21308,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1313
+            "line": 1315
           },
           "name": "fromRouterInputAttributes",
           "parameters": [
@@ -21354,7 +21354,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1182
+            "line": 1184
           },
           "name": "metric",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21386,7 +21386,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1197
+            "line": 1199
           },
           "name": "metricBitrate",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21413,7 +21413,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1233
+            "line": 1235
           },
           "name": "metricConnected",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21439,7 +21439,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1245
+            "line": 1247
           },
           "name": "metricContinuityCounterErrors",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21465,7 +21465,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1269
+            "line": 1271
           },
           "name": "metricFailoverSwitches",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21492,7 +21492,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1257
+            "line": 1259
           },
           "name": "metricLatency",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21518,7 +21518,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1209
+            "line": 1211
           },
           "name": "metricNotRecoveredPackets",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21544,7 +21544,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1221
+            "line": 1223
           },
           "name": "metricTotalPackets",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21575,7 +21575,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1285
+            "line": 1287
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -21592,7 +21592,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1369
+            "line": 1371
           },
           "name": "endpoints",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21613,7 +21613,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1367
+            "line": 1369
           },
           "name": "grants",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21629,7 +21629,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1362
+            "line": 1364
           },
           "name": "ipAddress",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21645,7 +21645,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1360
+            "line": 1362
           },
           "name": "routerInputArn",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21661,7 +21661,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1361
+            "line": 1363
           },
           "name": "routerInputId",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterInput",
@@ -21678,7 +21678,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1175
+            "line": 1177
           },
           "name": "routerInputRef",
           "overrides": "aws-cdk-lib.interfaces.aws_mediaconnect.IRouterInputRef",
@@ -21694,7 +21694,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1363
+            "line": 1365
           },
           "name": "createdAt",
           "optional": true,
@@ -21712,7 +21712,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1366
+            "line": 1368
           },
           "name": "transitEncryptionSecret",
           "optional": true,
@@ -21729,7 +21729,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 1364
+            "line": 1366
           },
           "name": "updatedAt",
           "optional": true,
@@ -21756,7 +21756,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 307
+        "line": 309
       },
       "name": "RouterInputAttributes",
       "properties": [
@@ -21769,7 +21769,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 311
+            "line": 313
           },
           "name": "routerInputArn",
           "type": {
@@ -21786,7 +21786,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 325
+            "line": 327
           },
           "name": "ipAddress",
           "optional": true,
@@ -21804,7 +21804,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 318
+            "line": 320
           },
           "name": "routerInputId",
           "optional": true,
@@ -21821,7 +21821,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Factory class for creating Router Input configurations.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -21835,7 +21835,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 846
+        "line": 848
       },
       "methods": [
         {
@@ -21849,7 +21849,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 862
+            "line": 864
           },
           "name": "failover",
           "parameters": [
@@ -21879,7 +21879,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 911
+            "line": 913
           },
           "name": "mediaConnectFlow",
           "parameters": [
@@ -21908,7 +21908,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 899
+            "line": 901
           },
           "name": "mediaConnectFlowWithoutConnection",
           "parameters": [
@@ -21938,7 +21938,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 928
+            "line": 930
           },
           "name": "mediaLiveChannel",
           "parameters": [
@@ -21968,7 +21968,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 945
+            "line": 947
           },
           "name": "mediaLiveChannelWithoutConnection",
           "parameters": [
@@ -22000,7 +22000,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 879
+            "line": 881
           },
           "name": "merge",
           "parameters": [
@@ -22029,7 +22029,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 852
+            "line": 854
           },
           "name": "standard",
           "parameters": [
@@ -22293,7 +22293,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for creating a Router Input.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -22302,7 +22302,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 261
+        "line": 262
       },
       "name": "RouterInputProps",
       "properties": [
@@ -22315,7 +22315,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 277
+            "line": 279
           },
           "name": "configuration",
           "type": {
@@ -22325,13 +22325,14 @@
         {
           "abstract": true,
           "docs": {
+            "remarks": "Must fall within the limits of the selected `tier`.",
             "stability": "experimental",
             "summary": "The maximum bitrate for the router input."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 268
+            "line": 269
           },
           "name": "maximumBitrate",
           "type": {
@@ -22347,7 +22348,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 270
+            "line": 271
           },
           "name": "routingScope",
           "type": {
@@ -22364,7 +22365,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 282
+            "line": 284
           },
           "name": "maintenanceConfiguration",
           "optional": true,
@@ -22382,7 +22383,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 287
+            "line": 289
           },
           "name": "regionName",
           "optional": true,
@@ -22400,7 +22401,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 266
+            "line": 267
           },
           "name": "routerInputName",
           "optional": true,
@@ -22418,7 +22419,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 292
+            "line": 294
           },
           "name": "tags",
           "optional": true,
@@ -22435,13 +22436,14 @@
           "abstract": true,
           "docs": {
             "default": "RouterInputTier.INPUT_20",
+            "remarks": "The tier determines the capacity limits, performance characteristics,\nand associated costs; `maximumBitrate` must fall within its limits.",
             "stability": "experimental",
-            "summary": "Select a tier based on your maximum bitrate requirements."
+            "summary": "Tier for this input."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 275
+            "line": 277
           },
           "name": "tier",
           "optional": true,
@@ -22460,7 +22462,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 301
+            "line": 303
           },
           "name": "transitEncryption",
           "optional": true,
@@ -22485,7 +22487,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 468
+        "line": 470
       },
       "methods": [
         {
@@ -22496,7 +22498,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 489
+            "line": 491
           },
           "name": "rist",
           "parameters": [
@@ -22525,7 +22527,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 474
+            "line": 476
           },
           "name": "rtp",
           "parameters": [
@@ -22554,7 +22556,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 519
+            "line": 521
           },
           "name": "srtCaller",
           "parameters": [
@@ -22583,7 +22585,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 504
+            "line": 506
           },
           "name": "srtListener",
           "parameters": [
@@ -22761,9 +22763,10 @@
     "@aws-cdk/aws-mediaconnect-alpha.RouterInputTier": {
       "assembly": "@aws-cdk/aws-mediaconnect-alpha",
       "docs": {
+        "remarks": "The tier determines the capacity limits, performance characteristics,\nand associated costs. The `maximumBitrate` must fall within the limits of the selected tier.",
         "stability": "experimental",
-        "summary": "Routing tier based on your maximum bitrate requirements.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
+        "summary": "Tier for a router input.",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -22772,7 +22775,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 223
+        "line": 224
       },
       "methods": [
         {
@@ -22782,7 +22785,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 235
+            "line": 236
           },
           "name": "of",
           "parameters": [
@@ -22810,7 +22813,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 243
+            "line": 244
           },
           "name": "toString",
           "returns": {
@@ -22831,7 +22834,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 225
+            "line": 226
           },
           "name": "INPUT_100",
           "static": true,
@@ -22848,7 +22851,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 229
+            "line": 230
           },
           "name": "INPUT_20",
           "static": true,
@@ -22865,7 +22868,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 227
+            "line": 228
           },
           "name": "INPUT_50",
           "static": true,
@@ -22881,7 +22884,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 240
+            "line": 241
           },
           "name": "value",
           "type": {
@@ -23398,7 +23401,7 @@
         },
         "locationInModule": {
           "filename": "lib/router-output.ts",
-          "line": 903
+          "line": 905
         },
         "parameters": [
           {
@@ -23427,7 +23430,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 823
+        "line": 825
       },
       "methods": [
         {
@@ -23439,7 +23442,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 840
+            "line": 842
           },
           "name": "fromRouterOutputArn",
           "parameters": [
@@ -23487,7 +23490,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 854
+            "line": 856
           },
           "name": "fromRouterOutputAttributes",
           "parameters": [
@@ -23533,7 +23536,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 759
+            "line": 761
           },
           "name": "metric",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23566,7 +23569,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 810
+            "line": 812
           },
           "name": "metricArqRequests",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23592,7 +23595,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 774
+            "line": 776
           },
           "name": "metricBitrate",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23619,7 +23622,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 798
+            "line": 800
           },
           "name": "metricConnected",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23645,7 +23648,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 786
+            "line": 788
           },
           "name": "metricTotalPackets",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23676,7 +23679,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 826
+            "line": 828
           },
           "name": "PROPERTY_INJECTION_ID",
           "static": true,
@@ -23692,7 +23695,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 899
+            "line": 901
           },
           "name": "ipAddress",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23708,7 +23711,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 896
+            "line": 898
           },
           "name": "routerOutputArn",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23724,7 +23727,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 898
+            "line": 900
           },
           "name": "routerOutputId",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23740,7 +23743,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 897
+            "line": 899
           },
           "name": "routerOutputName",
           "overrides": "@aws-cdk/aws-mediaconnect-alpha.IRouterOutput",
@@ -23757,7 +23760,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 752
+            "line": 754
           },
           "name": "routerOutputRef",
           "overrides": "aws-cdk-lib.interfaces.aws_mediaconnect.IRouterOutputRef",
@@ -23773,7 +23776,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 900
+            "line": 902
           },
           "name": "createdAt",
           "optional": true,
@@ -23790,7 +23793,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 901
+            "line": 903
           },
           "name": "updatedAt",
           "optional": true,
@@ -23817,7 +23820,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 200
+        "line": 202
       },
       "name": "RouterOutputAttributes",
       "properties": [
@@ -23830,7 +23833,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 204
+            "line": 206
           },
           "name": "routerOutputArn",
           "type": {
@@ -23847,7 +23850,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 221
+            "line": 223
           },
           "name": "routerOutputId",
           "optional": true,
@@ -23866,7 +23869,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 214
+            "line": 216
           },
           "name": "routerOutputName",
           "optional": true,
@@ -23897,7 +23900,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 534
+        "line": 536
       },
       "methods": [
         {
@@ -23910,7 +23913,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 602
+            "line": 604
           },
           "name": "mediaConnectFlow",
           "parameters": [
@@ -23941,7 +23944,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 623
+            "line": 625
           },
           "name": "mediaConnectFlowWithoutConnection",
           "parameters": [
@@ -23970,7 +23973,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 564
+            "line": 566
           },
           "name": "mediaLiveInput",
           "parameters": [
@@ -23999,7 +24002,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 579
+            "line": 581
           },
           "name": "mediaLiveInputWithoutConnection",
           "parameters": [
@@ -24029,7 +24032,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 553
+            "line": 555
           },
           "name": "standard",
           "parameters": [
@@ -24069,7 +24072,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 162
+        "line": 163
       },
       "name": "RouterOutputProps",
       "properties": [
@@ -24082,7 +24085,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 179
+            "line": 181
           },
           "name": "configuration",
           "type": {
@@ -24092,13 +24095,14 @@
         {
           "abstract": true,
           "docs": {
+            "remarks": "Must fall within the limits of the selected `tier`.",
             "stability": "experimental",
             "summary": "The maximum bitrate for the router output."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 169
+            "line": 170
           },
           "name": "maximumBitrate",
           "type": {
@@ -24114,7 +24118,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 171
+            "line": 172
           },
           "name": "routingScope",
           "type": {
@@ -24131,7 +24135,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 184
+            "line": 186
           },
           "name": "maintenanceConfiguration",
           "optional": true,
@@ -24149,7 +24153,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 189
+            "line": 191
           },
           "name": "regionName",
           "optional": true,
@@ -24167,7 +24171,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 167
+            "line": 168
           },
           "name": "routerOutputName",
           "optional": true,
@@ -24185,7 +24189,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 194
+            "line": 196
           },
           "name": "tags",
           "optional": true,
@@ -24202,13 +24206,14 @@
           "abstract": true,
           "docs": {
             "default": "RouterOutputTier.OUTPUT_20",
+            "remarks": "The tier determines the capacity limits, performance characteristics,\nand associated costs; `maximumBitrate` must fall within its limits.",
             "stability": "experimental",
-            "summary": "Routing tier that determines the maximum bitrate (in Mbps) for this output."
+            "summary": "Tier for this output."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 177
+            "line": 179
           },
           "name": "tier",
           "optional": true,
@@ -24234,7 +24239,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 291
+        "line": 293
       },
       "methods": [
         {
@@ -24246,7 +24251,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 329
+            "line": 331
           },
           "name": "rist",
           "parameters": [
@@ -24276,7 +24281,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 305
+            "line": 307
           },
           "name": "rtp",
           "parameters": [
@@ -24306,7 +24311,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 376
+            "line": 378
           },
           "name": "srtCaller",
           "parameters": [
@@ -24336,7 +24341,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 352
+            "line": 354
           },
           "name": "srtListener",
           "parameters": [
@@ -24514,9 +24519,10 @@
     "@aws-cdk/aws-mediaconnect-alpha.RouterOutputTier": {
       "assembly": "@aws-cdk/aws-mediaconnect-alpha",
       "docs": {
+        "remarks": "The tier determines the capacity limits, performance characteristics,\nand associated costs. The `maximumBitrate` must fall within the limits of the selected tier.",
         "stability": "experimental",
-        "summary": "Routing tier that determines the maximum bitrate (in Mbps) for a Router Output.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutput', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "summary": "Tier for a router output.",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveInput: medialive.IInput;\n\nconst output = new RouterOutput(stack, 'MediaLiveOutput', {\n  routerOutputName: 'medialive-output',\n  maximumBitrate: Bitrate.mbps(15),\n  routingScope: RoutingScope.GLOBAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.mediaLiveInput({\n    input: mediaLiveInput,\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -24525,7 +24531,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 52
+        "line": 53
       },
       "methods": [
         {
@@ -24535,7 +24541,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 64
+            "line": 65
           },
           "name": "of",
           "parameters": [
@@ -24563,7 +24569,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 72
+            "line": 73
           },
           "name": "toString",
           "returns": {
@@ -24584,7 +24590,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 54
+            "line": 55
           },
           "name": "OUTPUT_100",
           "static": true,
@@ -24601,7 +24607,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 58
+            "line": 59
           },
           "name": "OUTPUT_20",
           "static": true,
@@ -24618,7 +24624,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 56
+            "line": 57
           },
           "name": "OUTPUT_50",
           "static": true,
@@ -24634,7 +24640,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 69
+            "line": 70
           },
           "name": "value",
           "type": {
@@ -24710,7 +24716,7 @@
         "see": "https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html",
         "stability": "experimental",
         "summary": "SRT encryption configuration for router inputs and outputs (SRT Listener and SRT Caller).",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -24806,7 +24812,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Routing scope for the Router Input.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -25045,7 +25051,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 227
+        "line": 229
       },
       "name": "RtpOutputProtocolProps",
       "properties": [
@@ -25058,7 +25064,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 229
+            "line": 231
           },
           "name": "destinationAddress",
           "type": {
@@ -25074,7 +25080,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 231
+            "line": 233
           },
           "name": "port",
           "type": {
@@ -25091,7 +25097,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 236
+            "line": 238
           },
           "name": "forwardErrorCorrection",
           "optional": true,
@@ -25117,7 +25123,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 397
+        "line": 399
       },
       "name": "RtpProtocolProps",
       "properties": [
@@ -25130,7 +25136,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 399
+            "line": 401
           },
           "name": "port",
           "type": {
@@ -25147,7 +25153,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 404
+            "line": 406
           },
           "name": "forwardErrorCorrection",
           "optional": true,
@@ -26100,7 +26106,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Source priority configuration for failover Router Input configurations.",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\n\nconst input = new RouterInput(stack, 'FailoverInput', {\n  routerInputName: 'failover-input',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.failover({\n    networkInterface: networkInterface,\n    protocols: [\n      RouterInputProtocol.rist({\n        port: 5000,\n        recoveryLatency: Duration.millis(1000),\n      }),\n      RouterInputProtocol.rist({\n        port: 5002, // Must not be consecutive with primary port\n        recoveryLatency: Duration.millis(1000),\n      }),\n    ],\n    sourcePriority: SourcePriorityConfig.primarySecondary(PrimarySource.FIRST_SOURCE),\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -26109,7 +26115,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 362
+        "line": 364
       },
       "methods": [
         {
@@ -26119,7 +26125,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 366
+            "line": 368
           },
           "name": "none",
           "returns": {
@@ -26137,7 +26143,7 @@
           },
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 373
+            "line": 375
           },
           "name": "primarySecondary",
           "parameters": [
@@ -27074,7 +27080,7 @@
       "docs": {
         "stability": "experimental",
         "summary": "Properties for SRT Caller protocol configuration for outputs.",
-        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_50,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const networkInterface: RouterNetworkInterface;\ndeclare const role: iam.IRole;\ndeclare const secret: secretsmanager.ISecret;\n\nconst output = new RouterOutput(stack, 'EncryptedOutput', {\n  routerOutputName: 'encrypted-output',\n  maximumBitrate: Bitrate.mbps(10),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterOutputTier.OUTPUT_20,\n  configuration: RouterOutputConfiguration.standard({\n    protocol: RouterOutputProtocol.srtCaller({\n      destinationAddress: '203.0.113.100',\n      destinationPort: 9001,\n      minimumLatency: Duration.millis(200),\n      encryptionConfiguration: { role, secret },\n    }),\n    networkInterface: networkInterface,\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -27083,7 +27089,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 267
+        "line": 269
       },
       "name": "SrtCallerOutputProtocolProps",
       "properties": [
@@ -27096,7 +27102,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 269
+            "line": 271
           },
           "name": "destinationAddress",
           "type": {
@@ -27112,7 +27118,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 271
+            "line": 273
           },
           "name": "destinationPort",
           "type": {
@@ -27128,7 +27134,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 273
+            "line": 275
           },
           "name": "minimumLatency",
           "type": {
@@ -27145,7 +27151,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 283
+            "line": 285
           },
           "name": "encryptionConfiguration",
           "optional": true,
@@ -27163,7 +27169,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 278
+            "line": 280
           },
           "name": "streamId",
           "optional": true,
@@ -27189,7 +27195,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 435
+        "line": 437
       },
       "name": "SrtCallerProtocolProps",
       "properties": [
@@ -27202,7 +27208,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 441
+            "line": 443
           },
           "name": "minimumLatency",
           "type": {
@@ -27218,7 +27224,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 437
+            "line": 439
           },
           "name": "sourceAddress",
           "type": {
@@ -27234,7 +27240,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 439
+            "line": 441
           },
           "name": "sourcePort",
           "type": {
@@ -27251,7 +27257,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 451
+            "line": 453
           },
           "name": "decryptionConfiguration",
           "optional": true,
@@ -27269,7 +27275,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 446
+            "line": 448
           },
           "name": "streamId",
           "optional": true,
@@ -27412,7 +27418,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 252
+        "line": 254
       },
       "name": "SrtListenerOutputProtocolProps",
       "properties": [
@@ -27425,7 +27431,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 256
+            "line": 258
           },
           "name": "minimumLatency",
           "type": {
@@ -27441,7 +27447,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 254
+            "line": 256
           },
           "name": "port",
           "type": {
@@ -27458,7 +27464,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 261
+            "line": 263
           },
           "name": "encryptionConfiguration",
           "optional": true,
@@ -27484,7 +27490,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 420
+        "line": 422
       },
       "name": "SrtListenerProtocolProps",
       "properties": [
@@ -27497,7 +27503,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 424
+            "line": 426
           },
           "name": "minimumLatency",
           "type": {
@@ -27513,7 +27519,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 422
+            "line": 424
           },
           "name": "port",
           "type": {
@@ -27530,7 +27536,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 429
+            "line": 431
           },
           "name": "decryptionConfiguration",
           "optional": true,
@@ -27615,7 +27621,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-input.ts",
-        "line": 709
+        "line": 711
       },
       "name": "StandardConfigurationProps",
       "properties": [
@@ -27628,7 +27634,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 711
+            "line": 713
           },
           "name": "networkInterface",
           "type": {
@@ -27644,7 +27650,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 713
+            "line": 715
           },
           "name": "protocol",
           "type": {
@@ -27661,7 +27667,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-input.ts",
-            "line": 719
+            "line": 721
           },
           "name": "availabilityZone",
           "optional": true,
@@ -27687,7 +27693,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/router-output.ts",
-        "line": 462
+        "line": 464
       },
       "name": "StandardOutputConfigurationProps",
       "properties": [
@@ -27700,7 +27706,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 464
+            "line": 466
           },
           "name": "networkInterface",
           "type": {
@@ -27716,7 +27722,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 466
+            "line": 468
           },
           "name": "protocol",
           "type": {
@@ -27733,7 +27739,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/router-output.ts",
-            "line": 472
+            "line": 474
           },
           "name": "availabilityZone",
           "optional": true,
@@ -28094,7 +28100,7 @@
         "see": "https://docs.aws.amazon.com/mediaconnect/latest/ug/cross-service-confused-deputy-prevention.html",
         "stability": "experimental",
         "summary": "Transit encryption configuration for router integrations — securing the link between a router and a flow or a MediaLive channel/input.",
-        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_50,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
+        "example": "declare const stack: Stack;\ndeclare const mediaLiveChannel: medialive.IChannel;\ndeclare const transitSecret: Secret; // must hold the same value as the channel's MediaConnectRouterSettings.shared() secret\n\nconst input = new RouterInput(stack, 'ChannelInput', {\n  routerInputName: 'channel-input',\n  maximumBitrate: Bitrate.mbps(20),\n  routingScope: RoutingScope.REGIONAL,\n  tier: RouterInputTier.INPUT_20,\n  configuration: RouterInputConfiguration.mediaLiveChannel({\n    channel: mediaLiveChannel,\n    outputName: 'router-ts',\n    pipeline: MediaLivePipeline.PIPELINE_0,\n    sourceTransitDecryption: { secret: transitSecret },\n  }),\n});",
         "custom": {
           "exampleMetadata": "infused"
         }
@@ -29056,6 +29062,6 @@
       "symbolId": "lib/flow-output:ZixiPushOutputConfig"
     }
   },
-  "version": "2.270.0-alpha.0",
+  "version": "2.271.0-alpha.0",
   "fingerprint": "**********"
 }