MediaLive unable to open output or stream to MediaPackage

Question

Greetings - struggling with setting up output from MediaLive to MediaPackage.  I have tripled checked the role and policies required for MediaLive as per AWS documentation.  I have attempted 2 methods - the 'mediapackage' method and the HLS Output (Mediapackagev2).  Both are failing.  MediaLive and MediaPackage are setup in the same region on the same VPC subnet, with security group settings full allow on all traffic in and out.

MediaPackage ingress shows nothing.  No CloudWatch logs, no metrics, no data.  MediaLive logs do not show up in CloudWatch. IAM policies allow log group and stream creation.

MediaLive logs show the following:
sample of medialive Log When setup in 'mediapackage' mode:
OutputDataBackground failed to send file for URL [mediapackage://media-stim-8251-useast2-red/channel_1920_1080_20241024T141249_00031.ts], after [3] attempts, error [failed to write output to mediapackage]

[Muxer=MPEGTS[3]] unable to open output or stream [mediapackage://media-stim-8251-useast2-red/channel_1920_1080.m3u8].

#######
sample of medialive Log when channel setup as HLS out mode:
OutputDataBackground failed to send file for URL [https://6266309b4c9594fb.mediapackage.us-east-2.amazonaws.com/in/v2/4358f071f1d24283b3a171a9150018ac/4358f071f1d24283b3a171a9150018ac/channel_1_00089.ts], after [3] attempts, error [HTTP PROPFIND to [https

[Muxer=MPEGTS[1]] unable to open output or stream [https://6266309b4c9594fb.mediapackage.us-east-2.amazonaws.com/in/v2/4358f071f1d24283b3a171a9150018ac/4358f071f1d24283b3a171a9150018ac/channel_1.000086.m3u8].

What am I missing here?

Policy for the MediaLiveAccess role created by AWS with the 'update' button when creating channel is as follows:
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:ListBucket",
				"s3:PutObject",
				"s3:GetObject",
				"s3:DeleteObject"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"mediastore:ListContainers",
				"mediastore:PutObject",
				"mediastore:GetObject",
				"mediastore:DeleteObject",
				"mediastore:DescribeObject"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogGroup",
				"logs:CreateLogStream",
				"logs:PutLogEvents",
				"logs:DescribeLogStreams",
				"logs:DescribeLogGroups"
			],
			"Resource": "arn:aws:logs:*:*:*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"mediaconnect:ManagedDescribeFlow",
				"mediaconnect:ManagedAddOutput",
				"mediaconnect:ManagedRemoveOutput"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:describeSubnets",
				"ec2:describeNetworkInterfaces",
				"ec2:createNetworkInterface",
				"ec2:createNetworkInterfacePermission",
				"ec2:deleteNetworkInterface",
				"ec2:deleteNetworkInterfacePermission",
				"ec2:describeSecurityGroups",
				"ec2:describeAddresses",
				"ec2:associateAddress"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"mediapackage:DescribeChannel"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"mediapackagev2:PutObject",
				"mediapackagev2:GetChannel"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"kms:GenerateDataKey"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"secretsmanager:GetSecretValue"
			],
			"Resource": "*"
		}
	]
}

Mike-ME · Accepted Answer

Connecting MediaLive outputs to a MediaPackage can be performed by selecting either MediaPackage Output Group or the HLS Output Group. Both require the MediaPackage to exist already. There is no need for a VPC between MediaLive and MediaPackage.

Please review the following for the different methods of connecting MediaLive outputs to MediaPackage.
https://docs.aws.amazon.com/medialive/latest/ug/origin-server-hls-emp.html
https://docs.aws.amazon.com/medialive/latest/ug/origin-server-hls-empv2.html
https://docs.aws.amazon.com/medialive/latest/ug/opg-mediapackage.html

NOTE: when selecting to use the MediaPackage Output Group in MediaLive, many of the config parameters are automatically set and are hidden, unable to change.

re:Post Agent · Answer

Based on the information provided, there are a few potential issues that could be causing the problem with your MediaLive to MediaPackage setup:

1. Trusted Entity: It's important to note that MediaLive has permission to write to MediaPackage via a trusted entity relationship. This means you don't need user credentials to send a MediaPackage output to MediaPackage. Ensure that this trusted entity relationship has been properly set up in your AWS account.

2. Channel Configuration: For MediaPackage output, even if your MediaLive channel has two pipelines, you only need one MediaPackage channel. Make sure you've created only one MediaPackage channel.

3. Input Endpoints: For MediaPackage v2 (HLS output), you need to obtain the two URLs (input endpoints) for the channel from MediaPackage. These URLs start with "https://" and are slightly different from each other. Ensure you're using these correct URLs in your MediaLive output configuration.

4. SCTE-35 and Epoch Locking: If your input includes SCTE-35 messages and you're using epoch locking, be aware that MediaLive automatically disables SCTE-35 passthrough and manifest decoration in the MediaPackage output group when epoch locking is enabled. You may need to choose between keeping SCTE-35 messages or enabling epoch locking.

5. IAM Permissions: While your IAM policy seems comprehensive, ensure that the MediaLive role has the necessary permissions to perform actions in MediaPackage. This includes `Describe*`, `List*`, `Create*`, and `Delete*` actions for the MediaPackage service.

6. Network Configuration: Although you mentioned that MediaLive and MediaPackage are in the same VPC subnet with open security groups, double-check that there are no network-related issues preventing communication between the services.

If you've verified all these points and are still experiencing issues, you may need to contact AWS support for further assistance, as there could be an underlying service issue or a more complex configuration problem.  
**Sources**  
[Coordinate with the MediaPackage operator - MediaLive](https://docs.aws.amazon.com/medialive/latest/ug/origin-server-emp.html)  
[Requirements for AWS Elemental MediaPackage - MediaLive](https://docs.aws.amazon.com/medialive/latest/ug/requirements-for-mediapackage.html)  
[HLS output group to MediaPackage v2 - MediaLive](https://docs.aws.amazon.com/medialive/latest/ug/origin-server-hls-empv2.html)  
[Input and output requirements - MediaLive](https://docs.aws.amazon.com/medialive/latest/ug/pipeline-locking-verify-input.html)

jazzhands · Answer

Thank you Mike-ME your response ("there is no need for a VPC between MediaLive and MediaPackage") helped me appreciate the setup here.  I am used to elements being 'locked within a VPC', this is my first time using mediapackager.  I assumed I could use my internal VPC subnet to send output to MediaPackager, but nope this isn't supported it seems.

I had setup my channel output on Medialive to use the MediaPackager correctly, however I had selected the output delivery method as VPC.  Once I changed this to PUBLIC everything started working as expected.

Can the AWS designers please consider making the VPC option greyed out and not selectable when a user chooses the mediapackager option and force output to public?  This would have saved me precious time and more grey hairs ;)

MediaLive unable to open output or stream to MediaPackage

Relevant content