AutoGineer
Generated banner for AWS Media Services
Generated logo for AWS Media Services

AWS Media Services

AWSOfficialPublished by AWS

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Designs, deploys, reviews, evaluates, audits, and troubleshoots video streaming workflows across AWS media services (MediaConnect, MediaLive, MediaConvert, MediaPackage v2, MediaTailor, CloudFront). Includes per-service validation rules, cross-service workflow patterns for live streaming, linear channels, VOD pipelines, and live-to-VOD, service-specific troubleshooting, best practices assessment, cost optimization, encoder settings, DRM, SCTE-35 ad insertion, epoch locking, and CDN cache configuration.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured framework for managing end-to-end video streaming pipelines using AWS Media Services. It acts as an orchestrator that enforces mandatory rule-loading sequences to ensure configurations adhere to service constraints, security best practices, and performance requirements. It covers the full lifecycle of live, linear, and VOD workflows, including ingest, encoding, packaging, ad insertion, and CDN delivery.

What it does

  • Provides a mandatory dependency-based workflow for building and modifying streaming pipelines.
  • Enforces the loading of specific service rules to prevent configuration errors.
  • Offers a comprehensive troubleshooting guide for cross-service signal chain issues.
  • Includes a discovery checklist to gather requirements before resource deployment.
  • Defines strict startup and shutdown sequences for live streaming events.
  • Provides best practices for cost optimization and resilience in media architectures.

When to use it

  • When building or modifying live, linear, or VOD video streaming workflows.
  • When troubleshooting errors, latency, or sync issues across AWS media services.
  • When auditing existing configurations for compliance or performance optimization.
  • When planning a new media project and needing to understand service dependencies.
  • When configuring complex features like SCTE-35 ad insertion, DRM, or epoch locking.

Advantages

  • Prevents common configuration errors by enforcing dependency-aware resource creation.
  • Ensures compliance with service-specific constraints and security policies.
  • Reduces troubleshooting time by providing structured, service-specific diagnostic paths.
  • Promotes architectural best practices for resilience and cost efficiency.
  • Standardizes the approach to complex media tasks like ad insertion and CDN integration.

Usage examples

“I need to set up a live event workflow using MediaConnect, MediaLive, and MediaPackage. What is the correct order?”
The agent will load the core rules, the live event workflow file, and the relevant service rules, then guide you through the dependency-ordered creation process starting with VPC/IAM, followed by MediaPackage, MediaConnect, and finally MediaLive.
“My MediaLive channel is failing to start and showing pipeline errors. How do I fix it?”
The agent will load the core rules and the MediaLive troubleshooting file, then prompt you to check specific pipeline failover settings and encoder configurations based on the loaded rules.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/aws/aws-media-services/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip aws-media-services.zip -d .agents/skills

Documentation by AWS

AWS Media Services

Use this skill when the user is doing ANY of the following with AWS media services:

  • Building or modifying a video workflow (ingest, encoding, packaging, ad insertion, CDN delivery)

  • Reviewing, evaluating, or auditing an existing or proposed configuration for best practices, compliance, or correctness

  • Troubleshooting errors, alerts, or unexpected behavior

  • Asking questions about service constraints, compatibility rules, encoder settings, IAM policies, security groups, DRM, SCTE-35, caching, scaling, or any other AWS media topic

  • Planning a new workflow and needs to understand requirements, dependencies, or the discovery checklist

  • Optimizing cost, resilience, or performance of an existing workflow

If the user mentions ANY AWS media service by name (MediaConnect, MediaLive, MediaConvert, MediaPackage, MediaTailor) or related concepts (HLS, DASH, CMAF, ABR ladder, SCTE-35, epoch locking, origin shield, CDI, SRT, RTMP, transcode, live streaming, VOD pipeline, ad insertion, SSAI), load this skill.

This file is the orchestrator. It tells you which reference files to load based on the user's task. Do not load all files at once. Load on demand per the routing table below.

MANDATORY FIRST STEP — Read Before Doing Anything Else

STOP. Before you make ANY API call, pull ANY resource configuration, write ANY code, or produce ANY recommendation, you MUST load the required rule files into context. No exceptions. This applies to every task type: building, modifying, evaluating, troubleshooting, or answering questions.

The rule content is split across:

  • references/service-rules-core.md — cross-service compatibility constraints, common agent mistakes, and security considerations. ALWAYS loaded.

  • references/service-rules-encoding.md — shared encoder settings (QVBR, GOP, profiles, quality tuning, deinterlacing). Loaded for any encoding task.

  • references/service-rules-mediaconnect.md

  • references/service-rules-medialive.md

  • references/service-rules-mediaconvert.md

  • references/service-rules-mediapackage.md

  • references/service-rules-mediatailor.md

  • references/service-rules-cloudfront.md

Per-service rule files are loaded conditionally based on which services the query involves. Without the relevant rules loaded, you will produce recommendations based on general knowledge that may contradict the documented rules, flag correct configurations as problems, or miss critical constraints entirely.

Sequence (every time):

  1. Read references/service-rules-core.md — confirm it is in context before proceeding. ALWAYS required.

  2. Determine the task type and consult the Task Routing tables below to identify both the workflow/troubleshooting file AND the per-service rules to co-load.

  3. For ad-hoc questions that don't match a workflow or troubleshooting category: if the user names specific service(s), load those service rule files. If the question is symptom-based or you cannot determine which services are involved, load ALL per-service rule files.

  4. Only then begin resource discovery, API calls, or implementation.

If you find yourself about to call aws medialive describe-channel or similar and you have NOT yet read the core rules file plus the relevant per-service rules, stop and go back to step 1.

Task Routing

Building or modifying a workflow

Determine the workflow type. Load the matching workflow file AND the per-service rules listed in the right column (the core rules file is already loaded from the mandatory first step above).

Workflow typeWorkflow fileService rules to co-load
Live event (ingest → encode → package → deliver)references/workflow-live-event.mdmediaconnect + medialive + encoding + mediapackage + cloudfront (+ mediatailor if ads)
Linear channel (24/7 with schedule, ad insertion)references/workflow-linear-channel.mdmedialive + encoding + mediapackage + mediatailor + cloudfront
VOD pipeline (file-based transcode → package → deliver)references/workflow-vod-pipeline.mdmediaconvert + encoding + mediapackage + cloudfront
Live-to-VOD (live + archive/harvest → VOD transcode)references/workflow-live-event.md + references/workflow-vod-pipeline.mdunion of live event + VOD pipeline
Ad insertion (SSAI/CSAI, MediaTailor scaling)references/workflow-ad-insertion.mdmedialive + encoding + mediapackage + mediatailor + cloudfront
Contribution transport (MediaConnect, SRT, DX, encoders)references/workflow-contribution-distribution.mdmediaconnect + medialive + encoding
Router-based switching (master control, dynamic routing, playout)references/workflow-contribution-distribution.mdmediaconnect + medialive + encoding
Resilience (dual-AZ, dual-region, epoch locking, multi-CDN, ops readiness)references/workflow-resilience-patterns.mdALL (cross-cutting)
Cost optimization (reserved vs on-demand, channel classes, right-sizing)references/workflow-cost-optimization.mdALL (cross-cutting)
Subtitles and accessibility (captions, multi-language, auto-captioning)references/workflow-subtitles-accessibility.mdmedialive + mediaconvert + encoding
Troubleshooting

Load the relevant troubleshooting file(s) for the problem area AND the per-service rules listed in the right column. The core rules file is already loaded from the mandatory first step above. Load only the files needed.

Problem areaTroubleshooting fileService rules to co-load
MediaConnect flow issues, source connectivity, VPC interfaces, MediaConnect Routerreferences/troubleshooting-mediaconnect.mdmediaconnect
MediaLive channel errors, alerts, encoding, pipeline failoverreferences/troubleshooting-medialive.mdmedialive + encoding
MediaPackage ingest failures, manifest issues, access denied, v1→v2 migrationreferences/troubleshooting-mediapackage.mdmediapackage
MediaConvert job failures, codec errors, output issues, automationreferences/troubleshooting-mediaconvert.mdmediaconvert + encoding
MediaTailor ad insertion, ADS issues, SSAI scaling, session managementreferences/troubleshooting-mediatailor.mdmediatailor + medialive + mediapackage + cloudfront
CloudFront origin errors, cache behavior, multi-CDN, Embedded POPs (ePOP)references/troubleshooting-cloudfront.mdcloudfront + mediapackage
Cross-service signal chain (no video, latency, sync, AZ alignment, IAM, failover)references/troubleshooting-pipeline.mdALL
Quick reference

For a quick answer about a specific service's constraints, valid parameter values, or compatibility rules:

  1. references/service-rules-core.md is already loaded (mandatory first step).

  2. If the user names specific service(s) in the query, load those per-service rule files (e.g. references/service-rules-medialive.md).

  3. If the question crosses service boundaries (e.g., MediaPackage→MediaTailor compatibility), the cross-service rules are already in service-rules-core.md.

  4. If you can't determine which services are involved, load ALL per-service rule files.

This includes the following topics:

  • MediaTailor scaling patterns (multi-region, CDN origin shield, prefetch)

  • MediaConnect Router (paired resilient zonal endpoints) and downstream NDI converter caveats

  • Epoch locking and cross-region failover

  • Contribution transport (SRT tuning, Direct Connect sizing, RTP+FEC)

  • Multi-CDN architecture patterns

  • CloudFront advanced patterns (Embedded POPs / ePOP, CF Functions, segment sharding)

  • Operational readiness for live events (capacity planning, KPI baselines)

  • DRM production patterns and MediaPackage v1→v2 migration

  • Audio, HDR, and codec configuration details

Workflow Discovery Checklist

Before creating ANY resources for a new workflow, gather requirements from the user in a fixed order (mode → cost/scale → approach → source → network → encoding → ad insertion → packaging → IAM → VOD-specific). Do not proceed until all required items are answered; later questions depend on earlier answers.

Load references/workflow-discovery-checklist.md for the full ordered question set whenever building or modifying a workflow.

Plan Validation (before presenting to user)

Before presenting a proposed configuration to the user, cross-check against the loaded service rules:

  • Codec/container compatibility (e.g., HEVC requires fMP4, not TS)

  • GOP/segment duration alignment across all ABR rungs

  • Dependency ordering (downstream before upstream)

  • IAM trust policy includes all required service principals + sts:TagSession

  • IAM permissions scoped to specific resource ARNs (no Resource: "*")

  • Security posture (CIDR scoped, OAC configured, no Principal: *)

  • All prerequisite resources included (IAM roles, VPC, MediaPackage channel MUST be in the plan before resources that depend on them)

Do NOT make API calls during this step. This is a rules-based review of the proposed plan against constraints already in context.

Agents MUST NOT skip dependency steps to save time. All prerequisites (IAM, VPC, MediaPackage channel, etc.) MUST be created before resources that reference them. Skipping steps and fixing errors reactively leads to circular troubleshooting loops. Execute the plan in dependency order.

Resource Creation Order

Respect dependency order — a resource must exist before anything that references it (live chain, VOD chain, live-to-VOD addition, and the common flow patterns table).

Load references/resource-creation-order.md for the full dependency chains and flow-pattern table when creating resources.

Startup and Shutdown (Live Only)

Start upstream first and poll each resource to its ready state before proceeding (STARTING ≠ running); shut down in reverse (STOPPING ≠ stopped). Poll on a tight ~5s cadence.

Load references/startup-shutdown.md for the ordered start/stop tables and the polling pattern (including MediaConnect Router lifecycle) when operating a live workflow.

Tooling

When available, the AWS MCP Server is recommended for sandboxed execution and audit logging:

  • AWS MCP Server (aws-mcp-server): AWS API access, Agent SOPs for guided multi-step workflows, and documentation search via search_documentation and read_documentation.

  • AWS IaC MCP Server (aws-iac-mcp-server): CloudFormation template validation, CDK documentation search, CDK code samples, and IaC best practices.

Large response warning: MediaLive describe-channel and MediaPackage list-* calls return very large JSON. Always use --query (JMESPath) to extract only the fields you need.

# Good — extract only what you need
aws medialive describe-channel --channel-id 12345 --query "{State:State,Name:Name,Id:Id}"
aws medialive list-channels --query "Channels[].{Name:Name,Id:Id,State:State}"
aws mediapackagev2 list-origin-endpoints --channel-group-name X --channel-name Y \
  --query "Items[].{Name:OriginEndpointName,Url:HlsManifests[0].Url}"

Files

references/service-rules-cloudfront.md

Service Rules: CloudFront (media delivery)

Loaded conditionally when the task involves CloudFront (media delivery). The cross-service rules in service-rules-core.md are always loaded alongside this file.

CloudFront (media delivery)

Origin configuration

  • For MediaPackage v2: the origin endpoint URL MUST be used as the origin domain.

  • For MediaTailor: the MediaTailor playback URL MUST be used as the origin. MediaTailor returns child manifest URLs as relative paths with directory traversal (../../../); the CloudFront origin path depth MUST match what MediaTailor expects so relative URL resolution in the player still lands on the right cache behaviors. Leaving OriginPath empty is the simplest configuration that works in most cases. If a non-empty OriginPath is used, the cache behavior path patterns MUST be aligned to compensate.

  • MediaTailor session initialization (/v1/session/) supports both POST (JSON body) and GET (query parameters prefixed with ads. and manifestParams.). If using GET-based session init, no additional CloudFront method configuration is needed. If using POST-based session init, AllowedMethods MUST include POST.

  • For S3 VOD: OAC MUST be used.

Origin Shield (CRITICAL for live)

  • Origin Shield MUST be enabled on EVERY CDN pulling from MediaPackage v2.

  • MediaTailor's origin manifest fetches DO count against the MediaPackage v2 1000 manifest-RPS limit, but MediaTailor reuses a fetched origin manifest across player requests, so fetch volume sits well below player volume. Measure it by comparing Origin.Age SampleCount against the content origin's own access logs, not against Requests (which counts all request types and is not comparable). No documented setting reduces those fetches further, so where the limit binds the lever is a quota increase.

  • Origin Shield on the MediaTailor origin reduces the requests reaching MediaTailor from CloudFront edges. It does NOT reduce MediaTailor's own fetches from the content origin, so it MUST NOT be offered as a remedy for an origin RPS limit.

  • AWS does not recommend positioning a CDN between a content origin and MediaTailor: it introduces cache-key collisions, stale manifests, and corrupt gzip payloads that break manifest parsing, and it suppresses Origin.Age because that metric is emitted only when the response came from the origin. Diagnosis and the narrow gzip remedy are in troubleshooting-mediapackage.md.

  • The exception is channel assembly: where the content source is a channel assembly channel, AWS recommends a CDN in between as a best practice, because ad insertion can generate additional origin requests. Proxy the channel assembly manifests through the CDN and set the CDN-prefixed URL as the content source. Agents MUST NOT apply the general warning to a channel assembly source.

  • Removing a CDN from that leg can break manifest fetches with 403s if the origin policy names only the CDN. On MediaPackage v2 with SigV4, grant mediatailor.amazonaws.com principal access and mediapackagev2:GetObject first. Scope that service-principal grant against cross-service confused-deputy abuse: agents MUST add an aws:SourceAccount (your account id) condition and SHOULD add aws:SourceArn (the playback-configuration ARN) to the endpoint policy, so only your own MediaTailor configurations can assume the grant.

  • Target cache hit ratio: 90-100%.

Origin timeouts

  • Origin connection timeout SHOULD be lowered well below the segment duration so a slow origin doesn't tie up viewer-facing requests (a value around half the segment length is a common starting point). Default timeouts of 10s/30s MUST NOT be used for live streaming.

Error caching

  • Error response TTL SHOULD be set to a low value (around 1 second) for all live-streaming error codes (403, 404, 500, 502, 503, 504). The default 5-minute TTL MUST NOT be used for live.

Cache behavior for live

  • Separate cache behaviors for manifests vs segments are REQUIRED.

  • Manifest files (.m3u8, .mpd): TTL SHOULD be half segment duration (2-4 seconds for 6s segments).

  • Segment files (.ts, .m4s, .cmfv, .cmfa): TTL SHOULD be 24+ hours (segments are immutable).

  • Query string forwarding: all query strings MUST be forwarded.

  • Compression SHOULD be enabled on manifests.

CloudFront with MediaTailor — split-origin routing (RECOMMENDED)

When CloudFront fronts MediaTailor, the AWS-recommended pattern uses multiple origins with path-based routing for optimal caching and performance:

  • MediaTailor manifests origin — manifests.mediatailor.<region>.amazonaws.com. Serves personalized manifests, per-session media playlists, server-side beacon redirects and server-guided interstitial media. Paths: /v1/* (which covers /v1/master/*, /v1/manifest/*, /v1/dash/*, /v1/session/*, /v1/tracking/* and, at higher precedence, /v1/i-media/*) plus /segment/*. Omitting /v1/manifest/* breaks HLS playback because the per-session media playlist lives there, and omitting /segment/* breaks server-side beaconing.

  • MediaTailor ad segments origin — segments.mediatailor.<region>.amazonaws.com. Serves transcoded ad segments on /tm/*.

  • MediaPackage v2 origin — serves content segments (shared, cacheable). Paths: /out/v1/* (or whatever the MediaPackage endpoint path prefix is). Every MediaTailor behavior SHOULD carry a CORS response headers policy. Missing CORS headers on the ad segment behavior breaks playback in browser-based players.

MediaTailor rewrites manifests with segment URLs pointing back to CloudFront. If content segments route to MediaTailor instead of MediaPackage, players receive errors because MediaTailor does not serve content segments.

Cache behaviors, in precedence order:

  • /tm/* → ad segments origin, caching optimized, TTL 24h+, forward nothing (no headers, cookies or query strings in the cache key or origin request), CORS response headers

  • /v1/i-media/* → manifests origin, forward nothing, CORS response headers. Caching optimized only when guided prefetch is not in use. With guided prefetch, caching MUST be disabled on this path: the player's manifest refresh is the prefetch heartbeat, and a cache hit stops it reaching MediaTailor, which silently disables prefetching

  • /v1/* → manifests origin, caching disabled, forward all viewer headers and query strings, CORS response headers

  • /segment/* → manifests origin, caching disabled, forward all viewer headers and query strings, CORS response headers. This is the server-side reporting redirect, not an ad segment: it MUST reach MediaTailor on every view for the beacon to fire

  • /out/v1/* → MediaPackage v2 origin, TTL=24h+ (segments are immutable), Origin Shield enabled

Compression SHOULD stay enabled on the manifest behaviors. Manifests are the highest-request-rate text in the workflow, so compression there is a material delivery cost saving.

MediaTailor CdnConfiguration.ContentSegmentUrlPrefix MUST be set to the CloudFront distribution domain with the full MediaPackage path prefix (e.g., https://<cf-domain>/out/v1/<channel-group>/<channel>/<endpoint>) so that segment URLs in the rewritten manifest route through the correct CloudFront cache behavior to MediaPackage.

Without CdnConfiguration prefixes, MediaTailor emits origin-direct segment URLs, bypassing CloudFront caching. This works but loses CDN caching benefits for segments.

Cache behavior for VOD

  • Manifests MAY be cached longer (minutes to hours) since content does not change.

  • Segments SHOULD be cached indefinitely (immutable).

CORS for browser-based players

  • Browser-based players (hls.js, dash.js, Shaka) require CORS headers when the player application is served from a different origin than the media content. Without CORS, browser playback fails silently or with a network error.

  • CORS SHOULD be configured via a CloudFront Response Headers Policy (not S3 bucket CORS). Set Access-Control-Allow-Origin to the allowed application origins (or * for unrestricted), Access-Control-Allow-Methods to GET, HEAD, OPTIONS, and enable "Override origin" to ensure consistent headers regardless of origin behavior.

  • When building a VOD or live workflow intended for browser playback, agents SHOULD proactively include a CORS-configured Response Headers Policy on the CloudFront distribution.

Security response headers

  • CloudFront Response Headers Policies SHOULD include security headers for browser-delivered content: Strict-Transport-Security: max-age=31536000 (HSTS, 1 year), X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or SAMEORIGIN if the player must be embedded), and Referrer-Policy: strict-origin-when-cross-origin. AWS provides a managed SecurityHeadersPolicy that includes these.

  • These headers apply to manifest paths and any HTML/player pages served through the distribution.

OAC (Origin Access Control)

  • REQUIRED when restricting MediaPackage or S3 origin to CloudFront-only access.

  • OAC is the RECOMMENDED method for all production MediaPackage v2 deployments. It MUST be preferred over CDN authorization headers (X-MediaPackageV2-CDNIdentifier).

  • OAC uses SigV4 request signing — no shared secrets to rotate, cannot be spoofed.

  • When creating OAC for MediaPackage v2: signing protocol = SigV4, signing behavior = Always, origin service = mediapackagev2.amazonaws.com.

  • MediaPackage endpoint policy MUST allow the CloudFront distribution and MUST NOT retain Principal: "*" after OAC is configured.

Security

  • Signed URLs or signed cookies SHOULD be used for content access control.

  • Geo-restriction SHOULD be enabled (allowlist licensed territories only).

  • WAF + Shield Advanced is RECOMMENDED for all production distributions.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs a command-line tool

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/media-services-skills/aws-media-services · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS or AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-media-services.zip