Terraform for tvOS 26 Streaming Backends on AWS

resource "aws_mediapackage_channel" "live" {
  channel_id  = "live-channel"
  description = "Apple TV live channel"
}
 
resource "aws_mediaconvert_queue" "vod" {
  name        = "tvos-vod"
  description = "tvOS VOD encoding"
  pricing_plan = "ON_DEMAND"
  status       = "ACTIVE"
}

resource "aws_cloudfront_distribution" "tv" {
  enabled             = true
  is_ipv6_enabled     = true
  http_version        = "http2and3"
  default_root_object = "index.m3u8"
 
  origin {
    domain_name = aws_mediapackage_channel.live.hls_ingest[0].ingest_endpoints[0].url
    origin_id   = "mp-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }
 
  default_cache_behavior {
    target_origin_id       = "mp-origin"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    cache_policy_id        = data.aws_cloudfront_cache_policy.optimized.id
    compress               = true
  }
 
  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}

resource "aws_secretsmanager_secret" "fps" {
  name = "fps-cert"
}
 
resource "aws_lambda_function" "fps_kms" {
  function_name = "fps-key-server"
  role          = aws_iam_role.fps.arn
  package_type  = "Image"
  image_uri     = "${aws_ecr_repository.fps.repository_url}:${var.tag}"
  timeout       = 5
  memory_size   = 512
 
  environment {
    variables = {
      FPS_SECRET_ID = aws_secretsmanager_secret.fps.id
    }
  }
}