AutoGineer
Generated banner for AWS Media Services
Generated logo for AWS Media Services

AWS Media Services

AWSOfficialPublished by AWS

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Designs, deploys, reviews, evaluates, audits, and troubleshoots video streaming workflows across AWS media services (MediaConnect, MediaLive, MediaConvert, MediaPackage v2, MediaTailor, CloudFront). Includes per-service validation rules, cross-service workflow patterns for live streaming, linear channels, VOD pipelines, and live-to-VOD, service-specific troubleshooting, best practices assessment, cost optimization, encoder settings, DRM, SCTE-35 ad insertion, epoch locking, and CDN cache configuration.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured framework for managing end-to-end video streaming pipelines using AWS Media Services. It acts as an orchestrator that enforces mandatory rule-loading sequences to ensure configurations adhere to service constraints, security best practices, and performance requirements. It covers the full lifecycle of live, linear, and VOD workflows, including ingest, encoding, packaging, ad insertion, and CDN delivery.

What it does

  • Provides a mandatory dependency-based workflow for building and modifying streaming pipelines.
  • Enforces the loading of specific service rules to prevent configuration errors.
  • Offers a comprehensive troubleshooting guide for cross-service signal chain issues.
  • Includes a discovery checklist to gather requirements before resource deployment.
  • Defines strict startup and shutdown sequences for live streaming events.
  • Provides best practices for cost optimization and resilience in media architectures.

When to use it

  • When building or modifying live, linear, or VOD video streaming workflows.
  • When troubleshooting errors, latency, or sync issues across AWS media services.
  • When auditing existing configurations for compliance or performance optimization.
  • When planning a new media project and needing to understand service dependencies.
  • When configuring complex features like SCTE-35 ad insertion, DRM, or epoch locking.

Advantages

  • Prevents common configuration errors by enforcing dependency-aware resource creation.
  • Ensures compliance with service-specific constraints and security policies.
  • Reduces troubleshooting time by providing structured, service-specific diagnostic paths.
  • Promotes architectural best practices for resilience and cost efficiency.
  • Standardizes the approach to complex media tasks like ad insertion and CDN integration.

Usage examples

“I need to set up a live event workflow using MediaConnect, MediaLive, and MediaPackage. What is the correct order?”
The agent will load the core rules, the live event workflow file, and the relevant service rules, then guide you through the dependency-ordered creation process starting with VPC/IAM, followed by MediaPackage, MediaConnect, and finally MediaLive.
“My MediaLive channel is failing to start and showing pipeline errors. How do I fix it?”
The agent will load the core rules and the MediaLive troubleshooting file, then prompt you to check specific pipeline failover settings and encoder configurations based on the loaded rules.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/aws-media-services/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip aws-media-services.zip -d .agents/skills

Documentation by AWS

AWS Media Services

Use this skill when the user is doing ANY of the following with AWS media services:

  • Building or modifying a video workflow (ingest, encoding, packaging, ad insertion, CDN delivery)

  • Reviewing, evaluating, or auditing an existing or proposed configuration for best practices, compliance, or correctness

  • Troubleshooting errors, alerts, or unexpected behavior

  • Asking questions about service constraints, compatibility rules, encoder settings, IAM policies, security groups, DRM, SCTE-35, caching, scaling, or any other AWS media topic

  • Planning a new workflow and needs to understand requirements, dependencies, or the discovery checklist

  • Optimizing cost, resilience, or performance of an existing workflow

If the user mentions ANY AWS media service by name (MediaConnect, MediaLive, MediaConvert, MediaPackage, MediaTailor) or related concepts (HLS, DASH, CMAF, ABR ladder, SCTE-35, epoch locking, origin shield, CDI, SRT, RTMP, transcode, live streaming, VOD pipeline, ad insertion, SSAI), load this skill.

This file is the orchestrator. It tells you which reference files to load based on the user's task. Do not load all files at once. Load on demand per the routing table below.

MANDATORY FIRST STEP — Read Before Doing Anything Else

STOP. Before you make ANY API call, pull ANY resource configuration, write ANY code, or produce ANY recommendation, you MUST load the required rule files into context. No exceptions. This applies to every task type: building, modifying, evaluating, troubleshooting, or answering questions.

The rule content is split across:

  • references/service-rules-core.md — cross-service compatibility constraints, common agent mistakes, and security considerations. ALWAYS loaded.

  • references/service-rules-encoding.md — shared encoder settings (QVBR, GOP, profiles, quality tuning, deinterlacing). Loaded for any encoding task.

  • references/service-rules-mediaconnect.md

  • references/service-rules-medialive.md

  • references/service-rules-mediaconvert.md

  • references/service-rules-mediapackage.md

  • references/service-rules-mediatailor.md

  • references/service-rules-cloudfront.md

Per-service rule files are loaded conditionally based on which services the query involves. Without the relevant rules loaded, you will produce recommendations based on general knowledge that may contradict the documented rules, flag correct configurations as problems, or miss critical constraints entirely.

Sequence (every time):

  1. Read references/service-rules-core.md — confirm it is in context before proceeding. ALWAYS required.

  2. Determine the task type and consult the Task Routing tables below to identify both the workflow/troubleshooting file AND the per-service rules to co-load.

  3. For ad-hoc questions that don't match a workflow or troubleshooting category: if the user names specific service(s), load those service rule files. If the question is symptom-based or you cannot determine which services are involved, load ALL per-service rule files.

  4. Only then begin resource discovery, API calls, or implementation.

If you find yourself about to call aws medialive describe-channel or similar and you have NOT yet read the core rules file plus the relevant per-service rules, stop and go back to step 1.

Task Routing

Building or modifying a workflow

Determine the workflow type. Load the matching workflow file AND the per-service rules listed in the right column (the core rules file is already loaded from the mandatory first step above).

Workflow typeWorkflow fileService rules to co-load
Live event (ingest → encode → package → deliver)references/workflow-live-event.mdmediaconnect + medialive + encoding + mediapackage + cloudfront (+ mediatailor if ads)
Linear channel (24/7 with schedule, ad insertion)references/workflow-linear-channel.mdmedialive + encoding + mediapackage + mediatailor + cloudfront
VOD pipeline (file-based transcode → package → deliver)references/workflow-vod-pipeline.mdmediaconvert + encoding + mediapackage + cloudfront
Live-to-VOD (live + archive/harvest → VOD transcode)references/workflow-live-event.md + references/workflow-vod-pipeline.mdunion of live event + VOD pipeline
Ad insertion (SSAI/CSAI, MediaTailor scaling)references/workflow-ad-insertion.mdmedialive + encoding + mediapackage + mediatailor + cloudfront
Contribution transport (MediaConnect, SRT, DX, encoders)references/workflow-contribution-distribution.mdmediaconnect + medialive + encoding
Router-based switching (master control, dynamic routing, playout)references/workflow-contribution-distribution.mdmediaconnect + medialive + encoding
Resilience (dual-AZ, dual-region, epoch locking, multi-CDN, ops readiness)references/workflow-resilience-patterns.mdALL (cross-cutting)
Cost optimization (reserved vs on-demand, channel classes, right-sizing)references/workflow-cost-optimization.mdALL (cross-cutting)
Subtitles and accessibility (captions, multi-language, auto-captioning)references/workflow-subtitles-accessibility.mdmedialive + mediaconvert + encoding
Troubleshooting

Load the relevant troubleshooting file(s) for the problem area AND the per-service rules listed in the right column. The core rules file is already loaded from the mandatory first step above. Load only the files needed.

Problem areaTroubleshooting fileService rules to co-load
MediaConnect flow issues, source connectivity, VPC interfaces, MediaConnect Routerreferences/troubleshooting-mediaconnect.mdmediaconnect
MediaLive channel errors, alerts, encoding, pipeline failoverreferences/troubleshooting-medialive.mdmedialive + encoding
MediaPackage ingest failures, manifest issues, access denied, v1→v2 migrationreferences/troubleshooting-mediapackage.mdmediapackage
MediaConvert job failures, codec errors, output issues, automationreferences/troubleshooting-mediaconvert.mdmediaconvert + encoding
MediaTailor ad insertion, ADS issues, SSAI scaling, session managementreferences/troubleshooting-mediatailor.mdmediatailor + medialive + mediapackage + cloudfront
CloudFront origin errors, cache behavior, multi-CDN, Embedded POPs (ePOP)references/troubleshooting-cloudfront.mdcloudfront + mediapackage
Cross-service signal chain (no video, latency, sync, AZ alignment, IAM, failover)references/troubleshooting-pipeline.mdALL
Quick reference

For a quick answer about a specific service's constraints, valid parameter values, or compatibility rules:

  1. references/service-rules-core.md is already loaded (mandatory first step).

  2. If the user names specific service(s) in the query, load those per-service rule files (e.g. references/service-rules-medialive.md).

  3. If the question crosses service boundaries (e.g., MediaPackage→MediaTailor compatibility), the cross-service rules are already in service-rules-core.md.

  4. If you can't determine which services are involved, load ALL per-service rule files.

This includes the following topics:

  • MediaTailor scaling patterns (multi-region, CDN origin shield, prefetch)

  • MediaConnect Router (paired resilient zonal endpoints) and downstream NDI converter caveats

  • Epoch locking and cross-region failover

  • Contribution transport (SRT tuning, Direct Connect sizing, RTP+FEC)

  • Multi-CDN architecture patterns

  • CloudFront advanced patterns (Embedded POPs / ePOP, CF Functions, segment sharding)

  • Operational readiness for live events (capacity planning, KPI baselines)

  • DRM production patterns and MediaPackage v1→v2 migration

  • Audio, HDR, and codec configuration details

Workflow Discovery Checklist

Before creating ANY resources for a new workflow, gather requirements from the user in a fixed order (mode → cost/scale → approach → source → network → encoding → ad insertion → packaging → IAM → VOD-specific). Do not proceed until all required items are answered; later questions depend on earlier answers.

Load references/workflow-discovery-checklist.md for the full ordered question set whenever building or modifying a workflow.

Plan Validation (before presenting to user)

Before presenting a proposed configuration to the user, cross-check against the loaded service rules:

  • Codec/container compatibility (e.g., HEVC requires fMP4, not TS)

  • GOP/segment duration alignment across all ABR rungs

  • Dependency ordering (downstream before upstream)

  • IAM trust policy includes all required service principals + sts:TagSession

  • IAM permissions scoped to specific resource ARNs (no Resource: "*")

  • Security posture (CIDR scoped, OAC configured, no Principal: *)

  • All prerequisite resources included (IAM roles, VPC, MediaPackage channel MUST be in the plan before resources that depend on them)

Do NOT make API calls during this step. This is a rules-based review of the proposed plan against constraints already in context.

Agents MUST NOT skip dependency steps to save time. All prerequisites (IAM, VPC, MediaPackage channel, etc.) MUST be created before resources that reference them. Skipping steps and fixing errors reactively leads to circular troubleshooting loops. Execute the plan in dependency order.

Resource Creation Order

Respect dependency order — a resource must exist before anything that references it (live chain, VOD chain, live-to-VOD addition, and the common flow patterns table).

Load references/resource-creation-order.md for the full dependency chains and flow-pattern table when creating resources.

Startup and Shutdown (Live Only)

Start upstream first and poll each resource to its ready state before proceeding (STARTING ≠ running); shut down in reverse (STOPPING ≠ stopped). Poll on a tight ~5s cadence.

Load references/startup-shutdown.md for the ordered start/stop tables and the polling pattern (including MediaConnect Router lifecycle) when operating a live workflow.

Tooling

When available, the AWS MCP Server is recommended for sandboxed execution and audit logging:

  • AWS MCP Server (aws-mcp-server): AWS API access, Agent SOPs for guided multi-step workflows, and documentation search via search_documentation and read_documentation.

  • AWS IaC MCP Server (aws-iac-mcp-server): CloudFormation template validation, CDK documentation search, CDK code samples, and IaC best practices.

Large response warning: MediaLive describe-channel and MediaPackage list-* calls return very large JSON. Always use --query (JMESPath) to extract only the fields you need.

# Good — extract only what you need
aws medialive describe-channel --channel-id 12345 --query "{State:State,Name:Name,Id:Id}"
aws medialive list-channels --query "Channels[].{Name:Name,Id:Id,State:State}"
aws mediapackagev2 list-origin-endpoints --channel-group-name X --channel-name Y \
  --query "Items[].{Name:OriginEndpointName,Url:HlsManifests[0].Url}"

Files

references/service-rules-medialive.md

Service Rules: MediaLive

Loaded conditionally when the task involves MediaLive. The cross-service rules in service-rules-core.md are always loaded alongside this file.

MediaLive

Input creation

  • CDI inputs MUST be created as STANDARD class (two subnets REQUIRED).

  • The --input-class CLI parameter does not exist. Agents MUST NOT attempt to use it.

  • The channel class (SINGLE_PIPELINE or STANDARD) determines which pipeline endpoint is used, not the input class.

  • For single-pipeline channels using CDI, both subnets MUST be provided at input creation; the channel uses only one.

  • RTMP push inputs: MediaLive provides the ingest URL. Agents MUST NOT specify a source address.

  • SRT inputs: caller or listener mode and port MUST be specified.

Channel class

  • STANDARD: dual-pipeline, automatic failover. REQUIRES inputs that provide two sources of content (see below).

  • SINGLE_PIPELINE: single pipeline, lower cost. Uses only one endpoint/flow.

  • Channel class MUST NOT be changed after creation. The channel MUST be deleted and recreated.

STANDARD-class input requirements (per input type)

  • MEDIACONNECT input type: the input MUST reference TWO MediaConnect flow ARNs (one per pipeline). A single-flow MEDIACONNECT input on a STANDARD channel forces single-pipeline operation. The two flows SHOULD be in different AZs.

  • CDI input type: both subnets are provided at input creation; both MUST be in different AZs.

  • SRT, RTMP_PUSH, RTP (push-based): the input definition is a single object; MediaLive provisions two ingest endpoints automatically from it. The source encoder MUST push to both endpoints.

  • HLS pull, MP4 file (pull-based): the input definition is a single object containing the source URL(s). Both pipelines independently pull from the same source; no encoder push configuration is required.

Epoch locking

  • Epoch locking REQUIRES source timecode. Without it, epoch locking cannot synchronize segments. When the source's timecode capability is uncertain (e.g., RTMP from OBS, consumer encoders), agents MUST ask the user to confirm whether their source embeds UTC timecode before ruling epoch locking in or out.

  • Epoch locking is incompatible with SCTE-35 segmentation. ID3 metadata via MediaLive schedule actions MUST be used for ad break signaling instead — ID3 carries the cue payload without requiring a segment break, so it coexists with epoch locking.

  • Epoch locking MUST NOT be used with MediaPackage JIT packaging. Passthrough origins are REQUIRED.

Pipeline locking with file inputs

  • File inputs (S3 MP4/TS) do not contain live timecode. Standard pipeline locking based on timecode will not work.

  • InputClipSettings with a zero-based approach SHOULD be used to synchronize pipelines when using file inputs.

Input loss behavior

  • EMIT_OUTPUT: On input loss, the channel continues outputting black frames / silence. RECOMMENDED for production live events (prevents player buffering and stalls).

  • PAUSE: On input loss, the channel stops outputting. SHOULD be used only for cross-region epoch-locked workflows where a 4xx triggers region switch.

Encoder settings

  • SCTE-35 passthrough for HLS: Scte35Behavior: PASSTHROUGH MUST be set in M3u8Settings on each individual output. M3u8Settings is the ONLY correct location. It MUST NOT be placed at HlsGroupSettings level (that field does not exist there).

SCTE-35 setting disambiguation (agents frequently confuse these):

  • HLS output groups: Scte35Behavior: PASSTHROUGH in M3u8Settings, per-output (NOT at HlsGroupSettings level).

  • CMAF Ingest output groups: Scte35Type: SCTE_35_WITHOUT_SEGMENTATION in CmafIngestGroupSettings, group-level.

  • These are different settings for different output group types. They are NOT interchangeable.

  • GOP size MUST be identical across all ABR rungs for proper segment alignment.

  • GOP size SHOULD be 2 seconds (aligns with both HLS 6-second segments and DASH 2-second segments as an integer divisor). For Low-Latency HLS (LL-HLS), GOP size SHOULD be 1 second to match the shorter segment/part duration.

  • MediaPackage v2 supports two ingest types: CMAF (fMP4) and HLS (TS). The MediaLive output group MUST match the MediaPackage channel's InputType: CMAF InputType → CmafIngestGroupSettings; HLS InputType → HlsGroupSettings with CDN settings hls basic put. CmafIngestGroupSettings is RECOMMENDED for new workflows (fMP4, lower latency, segment reuse).

  • When duplicating a MediaLive channel for locking, redundancy, or cross-region failover, the duplicate MUST be an identical clone of the original except for: channel name, input attachment IDs, and channel class (a STANDARD primary with a SINGLE_PIPELINE backup in another region is allowed for cost optimization). All encoder settings, output group settings, output names/modifiers, GOP size, frame rate, segment duration, and SCTE-35 configuration MUST be identical.

  • Frame rate configuration differs by codec:

    • H.264: H264Settings.FramerateControl: INITIALIZE_FROM_SOURCE to match source frame rate automatically.

    • H.265: No FramerateControl field exists. Frame rate MUST be set explicitly via H265Settings.FramerateNumerator and H265Settings.FramerateDenominator (e.g., 60/1 for 60fps, 30/1 for 30fps, 30000/1001 for 29.97fps).

Codec constraints

  • H.264 (AVC): max practical resolution for live is 1080p. 4K AVC SHOULD NOT be used (requires 30+ Mbps, HEVC is RECOMMENDED instead).

  • H.265 (HEVC): supports up to 2160p (4K UHD). MAIN or MAIN_10BIT profile SHOULD be used. Industry-typical target for 4K HEVC live distribution: 10-20 Mbps with QVBR (sports/high-motion at the high end, low-motion at the low end).

  • A single channel MUST NOT output both H.264 and H.265 simultaneously. Separate channels are REQUIRED for multi-codec delivery. Both channels MUST target the same MediaPackage v2 channel via CMAF ingest so MediaPackage produces a unified multi-codec manifest. Routing to separate MediaPackage channels produces separate manifests and defeats the purpose of multi-codec ABR. GOP size, frame rate, segment duration, and output names MUST be identical across the codec channels so MediaPackage can align them into a coherent manifest.

  • AES-128 encryption MUST NOT be used with H.265/HEVC. AES-128 works only with H.264 in MPEG-TS segments. For encrypted HEVC delivery, CPIX/SPEKE with fMP4 segments MUST be used.

  • Heavy ABR stacks (many renditions at varying frame rates and codecs) MAY overwhelm the encoder. Shared encode outputs SHOULD be used where possible.

Audio configuration

  • Audio normalization SHOULD use ITU-R BS.1770 loudness normalization (current revision: BS.1770-4). Target: -16 LKFS (streaming) or -24 LKFS (broadcast alignment, e.g., ATSC A/85).

  • Surround audio SHOULD use EAC3 (Dolby Digital Plus, formal name "E-AC-3") at 192-384 Kbps as a separate rendition alongside stereo AAC.

  • Stereo audio SHOULD use AAC-LC at 64-128 Kbps. HE-AAC v1 at 32 Kbps MAY be used for lowest-bitrate mobile renditions.

  • Each language track REQUIRES a separate audio rendition.

HDR configuration

  • HDR10 MUST use HEVC MAIN_10BIT profile with BT.2020 colorspace and PQ (ST 2084) transfer function. fMP4 segments are REQUIRED (not MPEG-TS).

  • HLG MUST use HEVC MAIN_10BIT profile with BT.2020 colorspace and HLG transfer function.

  • DolbyVision REQUIRES external conversion. MediaLive does not natively generate DolbyVision metadata.

  • Loss-of-signal slates for HDR channels MUST be encoded with matching HDR metadata (colorspace, transfer function). SDR slates MUST NOT be used on HDR channels.

Output groups

  • CmafIngestGroupSettings: MUST be used for MediaPackage v2 CMAF ingest.

  • HlsGroupSettings: for HLS output to S3 or non-MediaPackage destinations.

  • ArchiveGroupSettings: for recording to S3 (MPEG-TS container).

  • MediaPackageGroupSettings: targets MediaPackage v1, which remains supported but is being superseded by MediaPackage v2. New workflows SHOULD target MediaPackage v2 via CmafIngestGroupSettings. Continue to use v1 only when an existing v1-dependent workflow does not justify migration cost.

  • A channel MAY have multiple output groups simultaneously.

  • CMAF Ingest outputs MUST contain only ONE track: either a video description, one audio description, or one caption description. Multiple tracks per output MUST NOT be used. Video, audio, and caption tracks MUST be separate outputs within the output group.

SCTE-35 in CMAF Ingest output groups

  • To pass SCTE-35 markers, Scte35Type in CmafIngestGroupSettings MUST be set to SCTE_35_WITHOUT_SEGMENTATION.

  • SCTE_35_ENHANCED and SCTE35_ENHANCED MUST NOT be used; they are not valid enum values.

  • Without setting Scte35Type, SCTE-35 markers from schedule actions will NOT appear in the CMAF ingest stream.

  • This is separate from Scte35Behavior in M3u8Settings (which applies to HLS output groups only).

State machine

  • Channel states: CREATING -> IDLE -> STARTING -> RUNNING -> STOPPING -> IDLE.

  • start-channel / stop-channel are async. Agents MUST poll State.

  • Channel MUST be IDLE to modify encoder settings or output groups.

  • start-channel returns immediately; channel state transitions through STARTING to RUNNING asynchronously. Provisioning time varies with channel class, codec, and resolution. Agents MUST poll until RUNNING rather than assume any specific duration. For time-sensitive events, start channels well in advance and verify they reach RUNNING before the event begins.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs a command-line tool

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/media-services-skills/aws-media-services · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-media-services.zip