An encoder can deliver perfectly healthy video from the wrong sender. Public contribution ingest needs source-access tests as well as picture-and-sound monitoring.
A live channel's ingest address is an operational dependency, but it is also a security boundary. A source can be unauthorized without producing a black frame, a packet-loss alarm or a decoding error. If a public push endpoint accepts unexpected traffic, the question is no longer just whether the feed is online. It is whether the intended sender is the one supplying it.
Why it matters
AWS's MediaLive input-security documentation, reviewed November 10, 2026, states that input security groups protect public RTP, RTMP push and non-VPC SRT listener inputs. AWS warns that account-level permissions do not by themselves prevent an outside party from pushing to a known input address and port.
That distinction is easy to miss in a conventional broadcast checklist. IAM governs who can configure a service; a network allowlist governs which upstream addresses can deliver media. Neither proves the editorial identity or correctness of the content. The controls address different failure modes.
This is not a claim that a particular broadcaster has suffered an ingest compromise. It is a commissioning and change-management risk operators can test before an event.
What the configuration actually protects
MediaLive allows up to ten CIDR rules per input security group, and one group can be shared across multiple inputs. That convenience creates a dependency: broadening a shared rule may expand access to several services, not just the feed being changed.
The scope matters. AWS says these input security groups do not apply to VPC-based RTP, RTMP or SRT inputs, or to MediaConnect and Elemental Link paths. Those need their own network and service-specific controls. Treating one console setting as universal protection would be incorrect.
For public RTP push, AWS documents two ingest endpoints and explains that a standard channel uses both, while a single-pipeline channel uses the first. An allowlist must therefore reflect the actual upstream egress addresses for the intended contribution paths, not the destination addresses alone.
Six acceptance tests before going live
1. Inventory the real senders. Record the primary and backup encoder egress IPs, NAT gateways, transport type, destination and owning team. Verify observed source addresses during a rehearsal rather than trusting a network diagram that may predate a routing change.
2. Prove the negative case. From a controlled, unauthorized test source, confirm that the endpoint refuses delivery. Run this without risking production and retain connection and network logs. A successful authorized push alone does not prove the boundary works.
3. Exercise the backup route. Fail over from primary to backup contribution and verify that the backup's actual public egress IP is permitted. Confirm the intended picture, audio and captions reach a downstream decoder after switching. Network acceptance is only the first check.
4. Review shared-rule blast radius. Identify every input that reuses the same security group. Before widening a CIDR, document which other channels would become reachable. Prefer narrowly scoped rules and a change owner.
5. Test configuration drift. Compare the deployed allowlist with an approved source inventory after vendor maintenance, cloud network changes and temporary event setups. Alert on unexpected changes, but do not confuse a configuration-drift alert with proof of malicious traffic.
6. Rehearse rollback. Remove an accidentally broad rule in a controlled environment and verify the approved source remains online. Record the decision path for emergency source-IP changes. If a channel uses SRT listener output, separately review MediaLive channel security group constraints, including which changes require a stopped channel. Input and output controls are not interchangeable.
The operator decision
Assign three independent pass criteria: the approved sender can connect; an unapproved sender cannot; and the received program is the intended program. Capture timestamped network evidence alongside decoded output evidence so security, NOC and master-control teams can resolve the same incident without guessing which layer failed.
The practical question for the next event is simple: if a vendor's contribution IP changes an hour before air, who can approve the change, how narrowly can it be applied, and how will the team prove that both the media and the access boundary remain correct?
Image credit: Original Amira Labs editorial diagram, November 10, 2026. Conceptual illustration of source allowlisting, not an actual MediaLive deployment.
Documentation reviewed November 10, 2026. This article is operational analysis, not a security assessment of a specific broadcaster.
