Issues with AWS MediaLive and MediaPackage Configuration

Question

Hello,

When the following three recurring messages appear in MediaLive > Channel > Alerts, what should I investigate?

1. MPEGTS muxer for mediaID [1] unable to close output or stream.
2. OutputDataBackground failed to send file for URL after [3] attempts, error [
3. MPEGTS muxer for mediaID [1] unable to open output or stream.

------

For reference, the settings are as follows:

[Input]: RTMP push

[Channel Details]:
- IAM role:  I have created an IAM role, referring to the following link: https://repost.aws/questions/QUgBBsHg0XRMCPOP__pec4Hw/failed-to-retrieve-mediapackage-credentials-for-channel-id
In particular, for MediaPackage, I have allowed all actions by using a wildcard (*) for permissions:

```
{
    "Effect": "Allow",
    "Action": [
        "mediapackage:*"
    ],
    "Resource": "*"
}

```

This configuration grants full permissions for all actions within MediaPackage and applies to all resources.

- Pipeline: Single pipeline

[Output Groups Detail: 2 HLS Output Groups]

Settings for the first HLS Group:
- HLS Group Destination A: https://b09fbxxxx.mediapackage.ap-xxxx.amazonaws.com/in/v2/3654c1xxxx/3654c1xxxx/channel
- Credentials: Used an existing parameter
- CDN Settings: HLS Webdav

Settings for the second HLS Group:
- HLS Group Destination A: s3://****/live2vod/$dt$/HLS/index
- CDN Settings: HLS Basic Put

The second HLS Group works without any issues, and the content is successfully saved as VOD. 
However, it appears that there is an issue with the first HLS Group, which sends content to MediaPackage. 
When the MediaPackage Channel's HLS endpoint URL is accessed with Safari, it shows a 404 error on a blank screen.

Based on the CloudWatch logs from MediaPackage (with some personal information redacted), it reveals the following:
- EgressAccessLogs: It shows a 404 status code.
- IngressAccessLogs: It shows a 401 status code.

- EgressAccessLogs Example:

```
{
    "timestamp": "2023-11-01T07:09:10.537127Z",
    "clientIp": "xxxx",
    "processingTime": 0.036,
**    "statusCode": "404",**
    "receivedBytes": 437,
    "sentBytes": 243,
    "method": "GET",
    "request": "https://acexxxx.mediapackage.ap-xxxx.amazonaws.com:443/out/v1/xxxx/index.m3u8",
    "protocol": "HTTP/2.0",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Whale/3.21.192.22 Safari/537.36",
    "account": "xxxx",
}
```

- IngressAccessLogs Example:

```
{
    "timestamp": "2023-11-01T06:59:15.466445Z",
    "clientIp": "****",
    "processingTime": 0.009999999999999998,
**    "statusCode": "401",**
    "receivedBytes": 285432,
    "sentBytes": 803,
    "method": "PUT",
    "request": "https://b09fbxxxx.mediapackage.ap-xxxx.amazonaws.com:443/in/v2/3654c1xxxx/3654c1xxxx/channel_480p20231101T065833_00006.ts",
    "protocol": "HTTP/1.1",
    "userAgent": "AWSElementalMediaLive",
}
```

I sincerely appreciate your help.
To protect personal information, certain details have been masked with "xxxx"

Answer

Hi JHKim,

From your description, you're using the HLS output group to send to MediaPackage. In that case it's necessary to create credential sets in the MediaLive channel configuration (open the twistie below the URL field). The IAM permissions you describe only work with the MediaPackage output group type.

Regards,
Steve

Answer

Hello Mike,

It seems that based on the errors you provided, MediaLive is not delivering to MediaPackage. Several things need to be verified for proper operation.
> Yes, you are correct. Thank you for clearly pointing out the cause.

How was the MediaLive Output Group defined? Using the MediaPackage or HLS selection?
> I used HLS selection.
HLS Output Group [1] consists of three outputs divided into 480p/720p/1080p. For HLS Output Group [2], I configured HLS group destination A to be saved in S3 for VOD. HLS Output Group [2] accumulates VOD files without any issues.

The MediaPackage Output Group type will automatically connect to MediaPackage using the MediaPackage ID.
> Yes, I'm aware of that. However, I've been consistently using the HLS Output group.

The HLS Output Group type will require the entry of the MediaPackage input URL, Username, and Password. Depending on which Output Group you chose, recheck all the needed parameters.
> Yes, I've double-checked several times. I'm really not sure what the root cause is.

Currently, there are two versions of MediaPackage. Both should be detailed in the MediaLive IAM Role that is used to enable MediaLive to deliver to any MediaPackage. The MediaLive IAM Role should contain something similar to this regarding MediaPackage: { "Effect": "Allow", "Action": [ "mediapackage:DescribeChannel" ], "Resource": "" }, { "Effect": "Allow", "Action": [ "mediapackagev2:PutObject" ], "Resource": "" } Consider updating your IAM role.
> I'm using the v1 version. Initially, I read in the documentation that only "DescribeChannel" is required for v1, so I applied that initially. However, as problems persisted, I changed the settings to { "Effect": "Allow", "Action": [ "mediapackage:*" ], "Resource": "" }. But I still received the same error message.

I sincerely appreciate your thorough response. I have indeed carefully reviewed the information you provided, but I'm still unsure where the issue is occurring. Is there anything else that might be overlooked?

Answer

Thanks for your question. The recommendation is to submit an AWS Support ticket for this  and allow the Support team to determine the cause of the errors.

It seems by the errors you provided that the MediaLive is not delivering to MediaPackage.
Several things need to be verified for proper operation.

How was the MediaLive Output Group defined? Using the MediaPackage or HLS selection?
The MediaPackage Output Group type will automatically connect the to MediaPackage using the MediaPackage ID. The HLS Output Group type will require entry of the MediaPackage input URL, Username and Password. Depending on which Output Group you chose, recheck all the needed parameters.

There are two versions of MediaPackage currently. Both should be detailed in the MediaLive IAM Role that is used to enable MediaLive to deliver to any MediaPackage.
The MediaLive IAM Role should contain similar to this regarding MediaPackage:
{
            "Effect": "Allow",
            "Action": [
                "mediapackage:DescribeChannel"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "mediapackagev2:PutObject"
            ],
            "Resource": "*"
        }
Consider updating your IAM role.

Answer

![Enter image description here](/media/postImages/original/IMbrPm3nL7S9yVPai9bnR_lg)

Hello Steve,
Thank you for your response!
As I mentioned in the main text, I have applied the Credential set. I'm attaching an image for your reference. Would you please take a look?

Issues with AWS MediaLive and MediaPackage Configuration

Relevant content