# VPC interfaces VPC interfacesVPC sources You can now connect your VPC to your AWS Elemental MediaConnect flow and send content to your flow without going over the public internet. A virtual private cloud (VPC) based on the Amazon Virtual Private Cloud service is your private, logically isolated network in the AWS Cloud. You can set up a VPC interface to establish a connection between your AWS Elemental MediaConnect flow and your VPC. For more information, see the following sections. + [Creating a transport stream flow that uses a VPC source](flows-create-vpc-source.md) + [Adding a VPC interface to a MediaConnect flow](vpc-interface-add.md) + [Removing a VPC interface from a MediaConnect flow](vpc-interface-remove.md) + [Adding a VPC source to an existing MediaConnect flow](source-adding-vpc.md) + [Adding VPC outputs to a flow](outputs-add-vpc.md) + [Security group considerations for VPC interfaces](vpc-interface-security-groups.md) # Adding a VPC interface to a MediaConnect flow Adding a VPC interface To avoid streaming your content over the public internet, you can add a VPC interface to your AWS Elemental MediaConnect flow. You can add up to two VPC interfaces to each flow. **Important** When you add a VPC interface, MediaConnect creates a service-managed Elastic Network Interface (ENI) in your AWS account. To ensure proper service operation, be sure not to modify this resource in any manner. ## Prerequisites Before you begin this procedure, make sure that you have completed the following steps: + In Amazon VPC, set up your VPC and associated security groups. For more information about VPCs, see the *[Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/)*. For information about configuring security groups to work with your VPC interface, see [Security group considerations](vpc-interface-security-groups.md). + In IAM, [set up MediaConnect as a trusted service](security-iam-trusted-entity.md). ## Procedure **To add a VPC interface to a flow (console)** 1. On the **Flows** page, choose the name of the flow that you want to update. 1. Choose the **VPC interfaces** tab. 1. Choose **Add VPC interface**. 1. For **Name**, specify a name for your VPC interface. The name of the VPC interface must be unique within the flow. 1. For **Network interface type**, specify the type of network adapter that you want MediaConnect to use on this interface. If you don't set this value, it defaults to **ENA**. **Note** You can add one EFA VPC interface per flow. You can add up to two ENA VPC interfaces per flow. You can only use an EFA VPC interface for sources that use the CDI protocol or the ST 2110 with JPEG XS protocol. 1. For **Role ARN**, specify the Amazon Resource Name (ARN) of the role that you created when you set up MediaConnect as a trusted service. 1. For **VPC**, choose the ID of the VPC that you want to use. 1. For **Subnet**, choose the VPC subnet that you want MediaConnect to use to set up your VPC configuration. The subnet must reside in the same Availability Zone as the flow. 1. For **Security groups**, specify the VPC security groups that you want MediaConnect to use to set up your VPC configuration. You must choose at least one security group. ## Additional resources VPC Flow Logs can be used to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to CloudWatch Logs, Amazon S3, or Data Firehose. For more information about VPC Flow Logs, see [Logging IP traffic using VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) in the *Amazon VPC User Guide*. # Removing a VPC interface from a MediaConnect flow Removing a VPC interface You can remove a VPC interface from your flow if it isn't used as a source for the flow. ## Prerequisites + The flow must be in **Standby**. + If the flow has an error, you must resolve the error before you complete the following procedure. ## Procedure **To remove a VPC interface from a flow (console)** 1. On the **Flows** page, choose the name of the flow that is associated with the VPC interface that you want to remove. 1. Choose **Stop**. The status of the flow changes to **Standby**. The flow stops immediately and is no longer viewable to customers who are accessing the output directly from your flow or through an entitlement. 1. Choose the **VPC interfaces** tab. 1. Choose the VPC interface that you want to remove, and then choose **Remove**. # Security group considerations for VPC interfaces Security group considerations When you set up a virtual private cloud (VPC) in Amazon Virtual Private Cloud, you create security groups that control inbound and outbound traffic. Then, when you create a VPC interface in AWS Elemental MediaConnect, you specify the security groups that you want MediaConnect to use when it sends and receives content from your VPC. To ensure that content can flow between your VPC and MediaConnect, adhere to the following guidelines: **** | If you have... | Make sure that the VPC interface has a security group with... | Additional information | | --- | --- | --- | | A VPC source | An inbound rule that allows the private IP address of the resource within the VPC that is sending content. | Zixi sources: When you create a VPC source using Zixi protocol, the inbound port is automatically assigned by MediaConnect. The assigned port will be in the range of 2090-2099 and assigned at the time of source creation. You should create the Zixi VPC source first and note the assigned port. After you have the assigned port information, you can configure your security groups. | | A VPC output | An outbound rule that allows all outbound traffic. By default, all security groups include this rule. As long as you haven't deleted that rule from the security group, you don't need to create a new one. | On the resource that receives traffic from your flow, you also need to set up a security group with an inbound rule that allows the private IP of the network interface ID that is associated with the VPC interface. (In MediaConnect, you can look at the flow details to find the network interface ID. Then in EC2, you [view details](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#view_eni_details) about the network interface to obtain the IP address.) | | A VPC source and a VPC output from the same VPC interface | An inbound rule and an outbound rule that meet the requirements listed above. | You can use one security group that has both rules or two security groups (one for each rule). For CDI flows, the security group specified for the VPC interfaces must be self referential. Verify that the security group used has the same security group ID added to both inbound and outbound rules. | For more information about security groups, see the [Amazon VPC User Guide](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html).