TerraformPilot

DevOps

Terraform for tvOS 26 Streaming Backends on AWS

Provision tvOS 26 streaming app backends with Terraform: MediaPackage HLS/DASH, MediaConvert encoding, CloudFront, and content protection (DRM).

LLuca Berton1 min read

tvOS 26 apps are mostly video. The cloud backend is straightforward: encode with MediaConvert, package with MediaPackage, deliver with CloudFront, and protect with FairPlay DRM. Terraform owns all of it.

Pipeline (TL;DR)

# 
resource "aws_mediapackage_channel" "live" {
  channel_id  = "live-channel"
  description = "Apple TV live channel"
}
 
resource "aws_mediaconvert_queue" "vod" {
  name        = "tvos-vod"
  description = "tvOS VOD encoding"
  pricing_plan = "ON_DEMAND"
  status       = "ACTIVE"
}

CloudFront Distribution

# 
resource "aws_cloudfront_distribution" "tv" {
  enabled             = true
  is_ipv6_enabled     = true
  http_version        = "http2and3"
  default_root_object = "index.m3u8"
 
  origin {
    domain_name = aws_mediapackage_channel.live.hls_ingest[0].ingest_endpoints[0].url
    origin_id   = "mp-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }
 
  default_cache_behavior {
    target_origin_id       = "mp-origin"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    cache_policy_id        = data.aws_cloudfront_cache_policy.optimized.id
    compress               = true
  }
 
  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}

FairPlay DRM Key Server (Lambda)

#

Apple TV requires FairPlay Streaming. Terraform provisions the issuer Lambda — the .p12 cert lives in Secrets Manager:

resource "aws_secretsmanager_secret" "fps" {
  name = "fps-cert"
}
 
resource "aws_lambda_function" "fps_kms" {
  function_name = "fps-key-server"
  role          = aws_iam_role.fps.arn
  package_type  = "Image"
  image_uri     = "${aws_ecr_repository.fps.repository_url}:${var.tag}"
  timeout       = 5
  memory_size   = 512
 
  environment {
    variables = {
      FPS_SECRET_ID = aws_secretsmanager_secret.fps.id
    }
  }
}

Best Practices

#
  • Pre-warm CloudFront for premieres — use cache invalidations sparingly.
  • HLS HEVC + AV1 for tvOS 26 — Apple TV 4K supports both.
  • Region-isolate live channels to satisfy licensing.
  • Sign DRM tokens with KMS, not in Lambda memory.
#
#Terraform#tvOS 26#Apple TV#AWS#Streaming

Share this article

Related articles