AWS Elemental Live DRM: SPEKE-based key delivery for live broadcast
AWS Elemental Live's DRM support via SPEKE — multi-DRM live (Widevine + FairPlay + PlayReady), key rotation per segment, and integration with AWS license-server partners.
AWS Elemental Live supports broadcast-grade live DRM via SPEKE-compatible key delivery to license-server partners. For protected live workflows — pay-per-view events, premium subscription live, contractual broadcast distribution — this integration is mature and broadly deployed.
What AWS Elemental Live actually has
SPEKE-based key delivery to license-server partners (Vualto, EZDRM, BuyDRM, AxinoDRM-style). Multi-DRM support: Widevine + FairPlay + PlayReady from the same encrypted live segments via CMAF + CENC cbcs encryption. Per-segment key rotation supported for studio-grade pre-release content. Integration with AWS Secrets Manager for license-server credential storage. AWS Elemental MediaPackage handles the DRM-aware packaging downstream of Elemental Live, with manifest manipulation per protocol (HLS, DASH, MSS). AWS account-level RBAC controls access to DRM-protected live channels.
Where it's the right fit
AWS-resident broadcast workflows where the full Elemental stack (Live + MediaPackage + MediaTailor + CloudFront) handles protected live end-to-end. Operators with established AWS procurement umbrellas and existing license-server vendor relationships (Vualto, EZDRM). Studio workflows where pre-release contractual protection requires per-segment key rotation.
Where the gaps show up
License-server is partner-provided, not AWS-built — you manage the license-server vendor relationship separately from your AWS contract. Cross-AWS-region DRM live (replicating protected live across regions for global audiences) is operationally complex. WebRTC live delivery with DRM is not in AWS Elemental Live's product (DRM works for HLS/DASH delivery only).
Pricing implications
DRM-protected live encoding via Elemental Live adds a per-input-channel-hour surcharge (typically 20-40% premium over un-DRMed live). License-server costs are separate, billed by the license-server partner. At 24/7 protected channels, expect $1,500-3,000/month per channel in AWS Elemental Live + license-server fees.
MpegFlow's DRM packaging architecture documents the SPEKE-based pattern. MpegFlow Live (2026 Q3) + native DRM (2026 Q4) target the same end-to-end protected-live workflow as AWS Elemental Live, with the orchestration-as-platform shape: workers don't carry license-server credentials, the coordinator generates per-segment SPEKE requests via the bridge service, and the audit log records key delivery + license requests for compliance verification.