For MediaLive inputs, the pull URL may be a bucket in a different account. Can we identify that it's an S3 format URL and then add a placeholder to show it's originating from a bucket?

First off, MSAM is very impressive and it looks like it could be a great fit for our live-stream monitoring needs.

I have noticed that there are some fairly loose permissions on a couple of the stacks referenced in the install guide. This seems to be particularly true for the custom CloudFormation resources. I think it could be helpful to refine some of these permissions, especially since much of the code lives in S3 and can be difficult to audit.

The most concerning to me are the following:

• The AdministratorAccess policy used by the MSAMCustomResourceRole in msam-browser-app-release.json
• The AdministratorAccess policy used by the DefaultSettingsResourceRole in msam-dynamodb-release.json

README.md
USAGE.md

Items in the layout table should be removed once items in the content table expire. We can add a daily scheduled job to remove any items from layout that no longer exist in content.

Currently, there is no way to remove obsolete items from the layout table.

Figure out a way to make the alerts text-based to account for folks who are color vision deficient

Different diagrams can contain the same elements.

Inventory drawer is a tree-like structure that can be organized by region or service. The drawer contains the entire inventory and elements can be selected and placed on custom diagrams.

Reduce the runtime role permissions to:
dynamodb:PutObject

api/msam/app.py is big and needs decomposition into modules.

Probably need a different way to update the informational layer so as not to trigger it too often, giving that flicker effect. I only see this on the local hosted app.
Code hosted on bucket doesn't seem to update information layer at all (might be addressed if informational layer is reworked).

Need to automate front-end and back-end tests
Invoke interactively from CLI
Invoke during automatic build

We'd like to be able to quickly play back video from various DASH, HLS endpoints, including MediaPackage, MediaConnect, etc.

Add initial display region (based on install region) and never-cache-regions to improve time to initial inventory collection.

Remove bucket policies, object ACLs.
Add CloudFront + Origin Access ID.

Need priority/timing for release.
Need reference to CloudFront/S3 best practice from AWS.

Internal user wants to visualize Direct Connect and resources connected through it.

Double-click near a node (diagram surface) to zoom in on closest node to click. This will help when zoomed-out.

Integrate classes and modules for managing multiple diagrams. Non-visible change; no UI changes. Global view diagram internally becomes a 'default' user defined diagram.

Diagram contents will come from Layout table!
Contents table will be used to feed upcoming inventory drawer.

Intended for unpredictable workloads. Update the CloudFormation templates to to remove ProvisionedThroughput attribute and add BillingMode = PAY_PER_REQUEST.

1. Nest existing CloudFormation templates into a single master template to simplify single-region installations
2. Find solution to manual merge required between SAM and CF templates
3. Add override parameters for base bucket name (currently rodeolabz)
4. Add override parameters for deployment regions (currently all/most)

These are intended to simplify 3rd party contributions and build testing independent of core team.

Add a checkbox to confirm storing the credentials locally. Allow user to 'opt-out' of storing credentials locally, which will require the user to re-enter credentials on first connection.

Search must iterate through the complete inventory and then identify each diagram containing that element.

Search results by diagram + tile view.

One possibility is to use AWS Systems Manager as the cloud-side integration.

Install SSM agent on each on-premise host
Tag the host to help MSAM identify it ("MSAM-Type: Encoder", "MSAM-Region: us-west-2")
MSAM's inventory process queries SSM database for inventory with above tags

Change the front-end for specific rendering needs of on-premise nodes.

dynamodb:scan was incorrectly dropped in a previous update.

REST_API.md should include resource descriptions and invocation process.

All diagrams need to react to event and alarm changes.

Add UI control for creating/updating/removing user defined diagrams.
Restore diagrams on start-up.

Add MediaTailor support, showing connections with MediaPackage, MediaStore, and/or S3.

Inventory elements with the tag "MSAM-Diagram=" will be used to define that diagram contents. That tag can occur multiple time per element so the element will appear on multiple diagrams.

Small tiles have only a name and status, and are intended for very large accounts with thousands of streaming channels.

Regular tiles are what we have today - name, resource counts, alarm and alert counts.

Allow a switch on the tile compartment between regular and small.

Need to be aware of SNMP traps sent from monitoring systems and associate those with cloud resources in the tool.

Add to Core API CloudFormation template.

Today the Detailed Model button on a tile switches to the Global View, hides unrelated elements, and zooms in on the remaining model.

With multi-diagram:

1. Detailed Model clicked
2. Find all diagrams with the tile's elements
3. Pop-up a list and let the user choose which diagram to switch to.
4. If all elements of the tile are not found on any existing diagram, generate a new diagram with just those elements. Let the user choose to keep it or now.

Provide a default TTL in Events template

Need to review the S3 to MediaLive connection code.

Tile tabs can be referenced groups of tiles with similar characteristics, like live or VOD, or category or rating.

Today we have a single tile tab, which may limit scaling out monitoring large number of channels.

Add HA_CONFIG.md to repo. The document should describe how MSAM can be used from an alternate region if the primary region goes down completely. This should include the process to install a high-availability configuration of MSAM, which includes using global tables in DynamoDB.

MediaConnect support is ready for integration testing once Lambda environment-supplied boto3 is updated.

Internal user wants to have multiple access roles for browser connections.

Operator (change anything, diagrams, tiles, alarms, etc.)
Viewer (read only, no changes to back-end)

Process for adding new users changes (IAM users, or Cognito user pool)
Stored credentials on browser-side changes

Browser code needs to be aware of read-only role

Reduce work browser must do to bootstrap the diagram. Perform connection identification to a scheduled Lambda and store connections from/to ARN in DynamoDB cache table. Unload all connections in a single API Gateway call.

It would be super handy if we can link to available tile tabs directly. This would allow for sharing content and landing on a specific tile tab page that you want to highlight. Currently, you can only link to the main MSAM page which takes you to the default Tiles tab.

Browser tool has problems over 2,000 nodes on the diagram. Need to perform some basic profiling and performance monitoring to understand the problem areas.

This helps for demo installations. Allow the user to provide an API endpoint and key as query parameters. Example:

../index.html?endpoint=https%3A%2F%2Fqsw0pljef6.execute-api.us-west-2.amazonaws.com%2Fmsam&key=PKICsVazoh7Ag9SrQ7RKm8cS2MJZCz9l6ef4hIng

This will override any previous settings and use this as the default. The user should get prompted, as usual, if the connection cannot be verified.

Inventory elements with the tag "MSAM-Tile=" will be used to define that tile's inventory. That tag can occur multiple time per element so the element will appear on multiple tiles.

Launch each node/connection discovery function in separate async Lambdas. They don't need to run sequentially.

Generate a CloudFormation template to duplicate existing cloud structure. Select one or more items from a diagram and get a CloudFormation template back.

What about custom resources for Lambda? Should this be one big custom resource?

We're hitting the tag retrieval API a lot for CloudFront distros. We need to increase throttling retries from the default (4) to a higher number, like 10.

How to display MediaLive/MediaPackage connections if they’re located in different AWS accounts?

Multiple REST endpoints can be supported. The internal model needs update to track which endpoint a particular node or edge originates.

Does any endpoint act as a 'master' or 'primary' endpoint, or is all everything distributed -- layout, settings, etc.

Currently, we're looking at tiles and the single model. Expand to include each diagram in search results. Navigation to that diagram on result click.

Multiple diagrams makes it difficult to navigate 'back' to the original model. When the Detailed Model button is clicked on a tile:

1. Find all diagrams with all elements of the tile and let the user choose which to show
2. If not found, generate a new diagram dynamically with the name of the tile with the tile contents

Hide the pre-layout resource hairball. This is a default layout with physics enabled to pull all elements toward the center of the diagram. This should only show if no other layout information is present in the database.

Can we find a better "default" layout mode for new elements/first run of the tool?