AWS and OBS live streaming setup

Create a live event in DRM-X#

1. Sign in to the customer console and select the organization and environment that will own the event.
2. Open Live events → New Live Channel. Enter a title. For a new account, choose Create new live content and enter a unique Content ID. Alternatively, select existing live content.
3. Choose the AWS region, rotation interval, and DVR window. Use the same AWS region for MediaLive, MediaPackage, and the SPEKE bridge. The starting values are 600 seconds for rotation and 7200 seconds for retained DVR media.
4. Create the channel. Save its one-time origin secret securely, together with the integration ID and separate DASH and HLS resource IDs. Never put the secret in a player, screenshot, support ticket, or public repository.

The DRM-X channel is a content and authorization configuration. Starting a DRM-X Live Run and starting the AWS encoder are separate operations.

Configure your AWS account#

1. Use an AWS account with billing enabled and an authorized operator who can manage CloudFormation, MediaLive, MediaPackage v2, API Gateway, IAM service roles, and CloudFront. Check regional quotas and current pricing before your rehearsal.
2. Download the DRM-X AWS CloudFormation template from the console. Create the stack with CreateMediaResources=false, the DRM-X integration/resource IDs, and the origin secret. The template creates scoped service roles and an IAM-authorized SPEKE bridge.
3. In DRM-X Configure AWS, enter your AWS account ID and the stack's exact SpekeRoleArn. Start the DRM-X Live Run so authenticated key requests can succeed.
4. Update the same stack with CreateMediaResources=true. Keep the existing secret and other parameters. Wait for the stack to complete.
5. Copy the stack outputs DashOriginUrl, HlsOriginUrl, DashCloudFrontUrl, and HlsCloudFrontUrl into the matching DRM-X fields. Viewers use the CloudFront URLs. The origin stays restricted to CloudFront.
6. Create a MediaLive RTMP push input. Allow only the broadcaster's current public IP with a /32 input security rule. An IP address changed by your ISP requires updating that rule.
7. Create the MediaLive channel with the stack's MediaLiveRoleArn, attach the input, and add a MediaPackage v2 CMAF output group using the stack's channel group and channel name. A single pipeline is suitable for a bounded test; a production event needs an appropriate redundancy design.

The template produces DASH-CENC for Widevine and PlayReady, and HLS-CBCS for FairPlay. Its PRESET_AUDIO_1 and PRESET_VIDEO_3 contracts separate audio, SD, HD, and UHD keys. Existing installations using PRESET_VIDEO_2 must review an encryption-contract update before adding UHD with a distinct policy. See AWS encryption presets.

Configure OBS Studio for 4K#

1. Duplicate your OBS profile and scene collection. Give them a recognizable live-event name.
2. Add the intended video or capture source. Confirm it is actually 3840×2160, fit it to the canvas, and verify its audio. For a rehearsal file, enable Loop. Hide unused window or desktop captures.
3. In Settings → Video, set both canvas and output resolution to 3840x2160 and choose 30 fps for this example.
4. In Output → Advanced → Streaming, choose a supported H.264 hardware encoder, such as NVIDIA NVENC H.264. Use CBR 18000 Kbps, a 2 s keyframe interval, high profile, and disable output rescaling. With NVENC, P5 and High Quality are a starting point; check encoding load during the rehearsal.
5. Use AAC audio and 48 kHz stereo. Disable unwanted microphone and desktop audio sources.
6. In Stream, select Custom. Split the MediaLive RTMP input URL into the server/application URL and its final stream-name component. Put the final component in Stream Key. Keep it masked.

Use a stable upload connection with headroom above the combined video and audio bitrate. If OBS reports sustained network or encoding drops, correct them before opening the event to viewers. See OBS hardware encoding guidance.

Configure adaptive outputs#

For the OBS settings above, use an AVC/UHD MediaLive input specification with a 20 Mbps maximum. Create the following H.264 outputs at 30 fps, with closed 2-second GOPs and aligned 6-second CMAF segments. Keep AAC audio in its own rendition.

These are rehearsal settings, not a quality guarantee. A 4K channel still needs lower renditions for smaller displays, constrained networks, and devices whose DRM security level limits quality. Check current MediaLive codec and resolution support when choosing a different encoder.

Reusing a channel after a previous event#

A running encoder is not proof that viewers receive fresh media. Check the MediaPackage manifest-last-updated header and the advertised resolutions. If a reused channel still serves old segments after an encoder or rendition change, follow the AWS channel-history reset procedure.

1. Confirm the previous DVR content can be permanently removed; a reset is not a rollback operation.
2. Stop OBS and the MediaLive channel. Wait until MediaLive is Idle.
3. In MediaPackage, reset history for the specific test channel. Wait at least 30 seconds after the reset completes.
4. Start MediaLive, wait for Running, then start OBS. Check fresh DASH/HLS media, SPEKE exchange, and device playback again.

Add the event to PHP, Android, and iOS#

Use the same live Content ID and environment across all examples. Keep Site Key and Access Key on your PHP server. The hosted sample event is aws-live-test-20260902, titled 4K Live DRM Test; it is available only while a rehearsal is running.

In PHP, add a trusted playlist entry with id, title, and type: live. Sign in again to refresh the sample's session entitlements. The backend resolves the registered live manifest and rejects a client-supplied type that does not match the catalog.

'playlist' => [
    ['id' => 'your-live-content-id', 'title' => 'My live event', 'type' => 'live'],
],

In Android, add DrmXPlaylistItem("your-live-content-id", "My live event", "live") and pass its content type when preparing playback. In the Apple sample, use DrmXPlaylistItem(contentId: "your-live-content-id", title: "My live event", contentType: .live). Live entries are for streaming and must not enter the offline-download queue.

Start, verify, and stop#

1. Start the DRM-X Live Run, then start the AWS MediaLive channel. Wait until MediaLive reports Running.
2. Start Streaming in OBS. Check its bitrate, dropped frames, audio, and encoder load.
3. Confirm advancing DASH/HLS manifests contain the expected representations and DRM signaling. Verify decoded picture and audio in a browser, Android Widevine, and iPhone FairPlay. Leave a player connected across at least one key rotation and test a fresh viewer afterward.
4. Stop OBS streaming, stop the MediaLive channel, and stop the DRM-X Live Run when the test ends. Confirm MediaLive returns to Idle.

Stopping OBS alone does not stop AWS encoder charges. Check retained input, packaging/storage, request, and delivery charges separately. See MediaLive pricing and your AWS billing console.

Verified rehearsal: 17 September 2026#

The channel supplied encrypted 3840×2160 video with lower adaptive renditions. A physical iPhone 11 decoded 4K and passed six minutes of playback across a 600-second key rotation. Samsung S24 Ultra passed ten minutes at 1080p, its reported display ceiling. Both devices passed a fresh join after rotation. These results apply to the tested devices, codecs and policy.

Use Android SDK 1.0.0-preview.13 or later for uncached live manifests. Upgrade the existing Android evaluation app in place to preserve downloaded videos. The updated Apple sample preserves the key ID and IV while compacting MediaPackage metadata to fit FairPlay’s 200-byte SPC identifier limit. Its resolution preference supplies both width and height so adaptive playback can reach 4K.

Safari live playback

Use Web SDK 1.2.0-preview.13 or later for Safari. It selects native Apple Media Keys when available on macOS, iOS and iPadOS, and keeps that API across live and VOD playlist changes. Live playback does not fall back to MSE/SINF, which can request stale initialization-segment keys after MediaPackage rotates its keys. Keep the exact current key ID and IV in the HLS signaling.

DRM-X SPEKE emits a compact KeyId/IV asset identifier so Safari can request FairPlay licenses within the identifier-size limit. The DRM License Token still authorizes the exact content and key. After updating Key Service, verify that its dependent SPEKE gateway is running; an encoder receiving video cannot publish fresh protected output while key delivery is unavailable.

A separate 15-minute Safari rehearsal verified advancing playback across a key rotation on Mac and iPhone. The iPhone used native Apple Media Keys; the Mac used modern EME for the rotation check, then passed a native Apple Media Keys fresh join after an intermittent modern-EME startup error. Recorded browser adaptation reached 720p on the Mac and 480p on the iPhone. This does not qualify 4K browser playback or rotation on the final Mac compatibility path. The native-app 4K result above is a separate test.

Before restarting a rehearsal

• Verify that the SPEKE endpoint is reachable and the console shows a recent exchange. An encoder receiving input can still serve stale media when key delivery fails.
• Keep VOD/offline media caches separate from the live manifest source.
• Check actual decoded dimensions; selecting a 4K channel alone does not prove 4K playback.
• This rehearsal is stopped. Start a new authorized DRM-X Live Run, AWS encoder and OBS stream before testing the live catalog entry again.