Streaming Video Encoding & Packaging Pipeline  ·  View 20 of 22  ·  Assurance

Security and Trust Zones

Five zones, and why the encode fleet gets one of its own.

Editable source SVG draw.io All views
Public internet Players Media CDN Rights holders Perimeter — authenticated, no content Signed upload endpoint Packaging origin encrypted segments only Job & lineage API workload identity Untrusted execution — the fleet decodes hostile input Decoder sandbox gVisor, no egress Encode workers read one prefix, write one Chunk scratch 48 h TTL Trusted platform Scheduler & governor Gate decision service Packager Manifest publisher Custody — highest sensitivity Pre-release masters CMEK, per-object audit Key broker + KMS keys never persisted here Audit log append-only Pre-release origin not publicly routable mTLS + signed URL write-once range read key per job, in memory manifest pointer ciphertext only HTTPS Security and Trust Zones External / third party Interface / broker Security / platform Application we own Data store Decision point synchronous The fleet sits in its own zone because a codec parser is the assumed attack surface, not the API. Two intra-zone writes are omitted: sandbox to scratch, and gate to the pre-release origin. v 1.0 · owner Media Platform Architecture

The fleet is untrusted

  • The assumed attack is a container escape through a codec parser handling a malformed or malicious master, not a request to the API.
  • So workers decode inside a sandbox with no egress, read one master prefix and write one rendition prefix, and hold a short-lived workload identity that grants nothing else.
  • That is also why an unreleased master is the highest-sensitivity asset in the system: per-object read auditing, alertable bulk reads, CMEK, and per-rights-holder key separation where a contract requires it.

One invariant with no exception

  • No fallback may weaken protection. Degrade quality, degrade latency, degrade the rung set — never encryption. A key service outage stalls publication and that is the whole of the handling.

Known clutter and omissions

  • Two intra-zone writes are omitted: sandbox to chunk scratch, and the gate to the pre-release origin.
  • Two label-position warnings survive from the route check on this view; both labels name a zone crossing and are worth more than the overlap costs.
◀  Rendition Lifecycle All views Identity, Keys and Licence Flow  ▶
Solution Architecture v1.0 · Google Cloud · Media Platform Architecture · 2026-10 · 22 views · 15 architecture decision records20-security-trust-zones