59 {{ upvoteCount | shortNum }}
59 {{ upvoteCount | shortNum }}

Amazon S3 Video Help Please :-)

by StevenUK
58 replies
Hi,

I am asking if somebody can help with Amazon S3 video hosting/streaming.

I know how to host and play the videos, but the videos I will be hosting in a members area will be paid for videos. Therefore how can I stop people from hot linking to the source of the video (Amazon S3 video bucket) and posting it online.

I tried an old PHP redirect script and placed it in the bucket but it didn't work, the video would not play.

So my question is, is there a way to stop people from hot linking to the videos with some kind of script or similar, when using Amazon S3 video?

I would appreciate any advice, and help.

Thanks,

Steven
#amazon #hotlinking with amazon s3 #video
  • Profile picture of the author alex93
    Originally Posted by StevenUK View Post


    Thanks,

    Steven

    What video player are you using, as some allow you to mask the video url, some also use secure streaming, like this for example.

    Configure Streaming Security Settings | Wowza Support
    {{ DiscussionBoard.errors[9860492].message }}
    • Profile picture of the author StevenUK
      Originally Posted by alex93 View Post

      What video player are you using, as some allow you to mask the video url, some also use secure streaming, like this for example.

      Configure Streaming Security Settings | Wowza Support
      Hi Alex, thanks for the reply.

      I am trying Video JS at the moment, which is a freeware video player. But I just cannot see anyway to stop the hotlinking. I looked at the link you provided, but all I could see was that if you host the video files with them they have security, but that would defeat the option of using Amazon s3?

      What free, or cheap video players have security built in to stop hotlinking that I can use with S3?

      Thanks.
      Signature

      {{ DiscussionBoard.errors[9863422].message }}
      • Profile picture of the author alex93
        Originally Posted by StevenUK View Post

        What free, or cheap video players have security built in to stop hotlinking that I can use with S3?

        Thanks.
        Not many that are decent, i tried several free versions to get my player to work, iv got over 15,000 videos, to be honest, you will not be able to stream these videos without some form of CDN.

        As Dave mentioned in some detail, you can mask, iv yet to do this, i i use flowplayer but any player will do, the main problem is speed, most severs will not handle video streaming, hence, RTMP, fast servers in multiple locations.It is also the cheapest option, i use Amazon S3 and Cloud, but you could use Cloudfare, other CDN networks, some are free up to a certain amount of Gig.

        Hence perfect if you only have a handful of videos, i am paying peanuts and showcasing several thousand.

        Flowplayer offer masking, and i am sure JW does as well, if you host with something like Amazon, use that fora masking as Dave pointed out, I am setting mine up as we speak, mainly as i am getting this problem, also getting shit loads of image hotlinking, 600,000 images, 20GB and several arseholes are raping my bandwidth. Grrr...
        {{ DiscussionBoard.errors[9871038].message }}
      • Profile picture of the author magentawave
        What did you end up doing to prevent the hotlinking of your S3 links? And are you using Optimizepress by chance?


        Originally Posted by StevenUK View Post

        Hi Alex, thanks for the reply.

        I am trying Video JS at the moment, which is a freeware video player. But I just cannot see anyway to stop the hotlinking. I looked at the link you provided, but all I could see was that if you host the video files with them they have security, but that would defeat the option of using Amazon s3?

        What free, or cheap video players have security built in to stop hotlinking that I can use with S3?

        Thanks.
        {{ DiscussionBoard.errors[10546346].message }}
        • Profile picture of the author StevenUK
          Originally Posted by magentawave View Post

          What did you end up doing to prevent the hotlinking of your S3 links? And are you using Optimizepress by chance?
          I couldn't find anything that worked in the end, and ended up using Vimeo, as nothing stopped people stealing videos.
          Signature

          {{ DiscussionBoard.errors[10554994].message }}
          • Profile picture of the author magentawave
            I looked at a ton of stuff and compared their features side-by-side and it came down to figuring out how to do the right bucket policy and permissions (which I haven't figured out after numerous attempts), or buying S3 Media Vault for $47 (which doesn't work with Cloudfront), or buying EasyVideoSuite for $200 (which might be obsolete in about six months when they roll out their new program).

            This article How to Prevent Hotlinking of Images Hosted on Amazon S3 explains an interesting way to prevent hotlinking that creates a redirect back to your site when someone copies your link. I haven't tried it yet but I might later today.

            Originally Posted by StevenUK View Post

            I couldn't find anything that worked in the end, and ended up using Vimeo, as nothing stopped people stealing videos.
            {{ DiscussionBoard.errors[10555714].message }}
            • Profile picture of the author David V
              Looks good. Yup , you can do some really cool things like the redirect. You can even customize the error that people get (Instead of that amazon xml error page).
              There are some good plugins (not too many though), and services. Basically they are connecting to amazon and doing the work for you.

              Learning and understanding it is worthwhile if you routinely use amazon s3 and/or cloudfront.
              Once you "get it" things really flow well and are easy to setup.
              {{ DiscussionBoard.errors[10555736].message }}
  • Profile picture of the author David V
    You need to create a bucket policy to restrict access only to your website (domain/IP) and make sure the ACL is not public.

    Much EASIER to use Cloudberry Explorer for this.

    If your on a Mac you can still use it if your running something like Parallels or VMware Fusion.

    Here's an example policy:

    Code:
    {
  "Id": "Policy1234",
  "Statement": [
    {
      "Sid": "SBP123",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::THEBUCKETNAME/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://YOUR-WEBSITE.com/*",
            "http://www.YOUR-WEBSITE.com/*",
            "http://YOUR-WEBSITE-IP-ADDRESS/*"
          ]
        }
      },
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    }
  ]
}
    Also, technically your not "streaming" if it's coming from a bucket.
    You can live stream from Cloudfront though.

    You'd also be better off to use a quality plugin which makes all this very easy.
    The RTMP Player Plugin (although ugly) works extremely well and is the most affordable S3 and cloudfront premium plugin.
    {{ DiscussionBoard.errors[9866356].message }}
    • Profile picture of the author magentawave
      I have three questions that I'm hoping you can help me with, please.

      1) If I want my S3 videos and other S3 links to work on my sites ONLY then what do you add to the bucket policy below that I put in red?

      2) I have tried about 4 or 5 different bucket policies and some worked in preventing my videos from being played on any site but my own, but the videos wouldn't play on mobile devices like Android and iPads. Is there something I can add to a bucket policy so the videos will play on mobile devices?

      3) My site is SSL. The primary site for the cpanel is MySite.com and MySite.com/xx and MySite.com/xxxx are in two different folders/directories in the same cpanel. Since it's SSL and since they are in the same cpanel, do I need to add ALL of the url's as shown below to the bucket policy, or just the several iterations of MySite.com? (I tried adding all of the url's like below but when I tried to save the bucket policy Amazon said: "Policy could not be parsed as a valid JSON string"

      "https://www.MySite.com/*",
      "https://www.MySite.com/xx/*",
      "https://www.MySite.com/xxxx/*",
      "http://www.MySite.com/*",
      "http://www.MySite.com/ic/*",
      "http://www.MySite.com/xxxx/*",
      "https://MySite.com/*",
      "https://MySite.com/xx/*",
      "https://MySite.com/insidersclub/*",
      "http://MySite.com/*",
      "http://MySite/xx/*",
      "http://MySite.com/xxxx/*"

      Thanks



      Originally Posted by David V View Post

      You need to create a bucket policy to restrict access only to your website (domain/IP) and make sure the ACL is not public.

      Much EASIER to use Cloudberry Explorer for this.

      If your on a Mac you can still use it if your running something like Parallels or VMware Fusion.

      Here's an example policy:

      Code:
      {
  "Id": "Policy1234",
  "Statement": [
    {
      "Sid": "SBP123",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::THEBUCKETNAME/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": [
            "http://YOUR-WEBSITE.com/*",
            "http://www.YOUR-WEBSITE.com/*",
            "http://YOUR-WEBSITE-IP-ADDRESS/*"
          ]
        }
      },
      "Principal": {
        "AWS": [
          "*"
        ]
      }
    }
  ]
}
      {{ DiscussionBoard.errors[10546344].message }}
  • Profile picture of the author silvia1003
    Have a Idea Domain to share
    .SG Domain COUPON CODE Share Out, only SGD7.99
    COUPON CODE: 2016_HongBao_Promo

    Visit Us: Buy .SG/COM.SG - Singapore Domain Name - Exabytes.SG
    {{ DiscussionBoard.errors[10546846].message }}
  • Profile picture of the author David V
    magentawave, you might want to read this AWS3 article. Some decent information.

    You should really consider running these through cloudfront and just use the buckets for storage and fallback.

    Amazon also has a bucket policy generator which should help you fine-tune it to your needs. Definitely read the help/dev docs.
    {{ DiscussionBoard.errors[10549624].message }}
    • Profile picture of the author magentawave
      I tried about 5 different bucket policies and none of them prevent people from viewing the source code and then downloading and hot linking my S3 URL's. After much research, I found out that S3 Media Vault and EasyVideoSuite can do this.

      That article on how to set up Cloudfront is excellent. Thank you!

      EDIT: I have a couple questions about Cloudfront, please.

      1) Does it cost more to stream from Cloudfront than it does from the S3 bucket?

      2) Is there any downside to using Cloudfront?

      3) It said this at the article you gave me the link to:
      The CloudFront Origin Access Identity, which is a special Cloudfront user is used to restrict access to the content in S3 buckets. The access is given only through the CloudFront so that the users cannot access the content directly by using S3 url.

      Does that mean that using Cloudfront will prevent people from viewing the source code and then using my S3 links to either download my stuff or hot link to it?

      4) Does using Cloudfront actually change the words, characters, etc. in the S3 URL's?

      Thanks



      Originally Posted by David V View Post

      magentawave, you might want to read this AWS3 article. Some decent information.

      You should really consider running these through cloudfront and just use the buckets for storage and fallback.

      Amazon also has a bucket policy generator which should help you fine-tune it to your needs. Definitely read the help/dev docs.
      {{ DiscussionBoard.errors[10550728].message }}
      • Profile picture of the author David V
        Originally Posted by magentawave View Post

        1) Does it cost more to stream from Cloudfront than it does from the S3 bucket?

        2) Is there any downside to using Cloudfront?

        3) It said this at the article you gave me the link to:
        The CloudFront Origin Access Identity, which is a special Cloudfront user is used to restrict access to the content in S3 buckets. The access is given only through the CloudFront so that the users cannot access the content directly by using S3 url.

        Does that mean that using Cloudfront will prevent people from viewing the source code and then using my S3 links to either download my stuff or hot link to it?

        4) Does using Cloudfront actually change the words, characters, etc. in the S3 URL's?

        Thanks
        Adding Cloudfront does add to the cost, but it's negligible. I've had membership sites with with many GB's of video streaming cost me $6. month total for the s3 and cloudfront.

        I can't think of any downside. I've never had an issue in years.

        The url's generated by cloudfront are different than s3.
        The url is not the problem or the way people are accessing your videos/info. It's the security.
        If you want to pretty them up, use cnames.
        Amazon also has a test tool to test your links.

        For the other questions I'll say this.

        This entire topic can be simple yet very complex quickly. There are a lot of moving parts and details.

        First, if you've implemented security protocols yet people can still access your bucket content, then you've made a little mistake somewhere.
        Walking though this step by step would take up several pages, and is really a course in itself.
        I'll just highlight a few things.
        - Create custom IAM credentials
        - Protect the bucket by giving only access to the owner and/or the IAM user you created for that purpose.
        - Give access to the Cloudfront distribution if using that.
        - When you setup your buckets, the settings will depend on the purpose. If they are for storing videos that are rtmp streamed via cloudfront, the settings are different than using the bucket for other purposes.
        - Bucket policies do work, there must be a minor error somewhere.

        Amazon has improved their dashboard for managing the buckets and cloudfront, BUT there are still many features you cannot do without using either Bucket explorer or Cloudberry explorer.
        The reason is they DO the programming for you. Otherwise you'll need to do it manually inside amazon.
        Just their tutorial videos alone will help you greatly in learning more about s3 and cloudfront.
        Cloudberry videos
        Bucket explorer info

        There are other apps out there, but none have quite the features these do.

        I could go on for hours on this topic, it's that big.
        Yes, there are plugins and tools you can use on your site that do much of this for you and they can be very helpful.
        Maybe I'll write a blog post(s) on this subject since it can be confusing until you've done it a few dozens times.

        -- Sorry for the messy writing, I'm short on time at the moment..




        A Quick Example:
        I won't go into explicit detail, just a process overview.
        I had a membership site that had streaming videos, zips, and pdf's and I wanted to protect them so only logged in users on my site could access them.
        I'm not too keen on using any plugin that uses ioncube or encryption in the source code since I cannot modify or create addons for it easily.
        That eliminates many s3 type plugins... but I'll get back to that.

        I setup a custom user in my Amazon dashboard, and a custom group (Groups are not required but helpful for credential organization)

        I setup a bucket for the assets and split it's usage for use with RTMP streaming and as a fallback.
        The only allowed access for the bucket were cloudfront and my custom user. Also a bucket policy was applied that only allowed my site url and/or IP address to access it's contents. I also setup cnames so my cloudfront urls would be clean... like "memberassets.mywebsite.com"

        On the site, I initially used a plugin for the streaming and protection but found it wasn't updated very often.
        I created my own plugin and it allowed me to protect and serve any asset to members as well as use ssh .pem (.pem, .key, .cer, .cert) that sat behind the server root. Why is this important? So you don't have raw amazon credentials sitting in the WP database unencrypted.

        The expiration of the protected link could also be set to anything. If you were to copy a url and use it off the site or when not logged in it will give an error and not work. If you were to use the url while logged in but you let the page sit too long (Like going to eat dinner than coming back to the computer) the link would have expired and you'd need to refresh the page while logged in to reactivate the link.

        Besides the Amazon side of this (Bucket & Cloudfront), you'll really want a plugin on your site (If WordPress) to generate the expiring urls. You cannot do this manually without it being time consuming and a pain.

        The overall idea...
        Create a user (In Amazon) with just enough permissions to accomplish the task.
        Create a bucket and protect it with a policy and limited user access, the ACL. (Never public).
        Create a Cloudfront distribution to pull from the bucket and connect it to the bucket.
        Test everything before even going to the website side of this. You shouldn't be able to access any asset.
        On the website, use a plugin for connecting with Amazon and creating expiring urls.
        Test everything again.
        Use another site you own to try and hotlink one of your assets, see what happens. It shouldn't work.
        Use an Amazon "bucket ripper" to see if you can pull anything out of the bucket. It shouldn't work.
        A bucket ripper (or other names) is used by lower life forms to scan S3 buckets for assets and weaknesses.

        Hope this was somewhat helpful.

        P.S. - A common mistake is setting the ACL wrong. If you set restriction on a folder let's say, but do not have contents "inherit" those permissions, then you'll have some assets protected, and some will not. Set permission from the "top" of the hierarchy and have it inherit "down" the hierarchy.
        {{ DiscussionBoard.errors[10555581].message }}
        • Profile picture of the author magentawave
          Thanks for taking the time to tell me about that stuff. I have a few questions when you get a chance, please.


          Originally Posted by David V View Post

          The url's generated by cloudfront are different than s3.
          And adding Cloudfront does not instantly protect my S3 URL's, right? I'm asking because I thought I read somewhere that Cloudfront offers protection to S3 that having S3 alone doesn't.



          Originally Posted by David V View Post

          Adding Cloudfront does add to the cost, but it's negligible.
          Does Cloudfront have a fixed monthly fee or is the cost based on usage like S3? Does turning Cloudfront "ON" work on ALL of your buckets in your S3 account or do you need to specify which buckets you want Cloudfront to work with?



          Originally Posted by David V View Post

          Amazon has improved their dashboard for managing the buckets and cloudfront, BUT there are still many features you cannot do without using either Bucket explorer or Cloudberry explorer.
          The reason is they DO the programming for you.
          And by "programming" you mean that I can specify what I want done in Bucket Explorer or Cloudberry Explorer like making my videos NOT play on other peoples sites and no downloading of my stuff and one of those programs will do it for me? Is Bucket Explorer and Cloudberry Explorer any different than free stuff like Cyberduck or S3 Fox?



          Originally Posted by David V View Post

          I also setup cnames so my cloudfront urls would be clean... like "memberassets.mywebsite.com"
          And is the reason for making clean looking links so they are easy for you to identify later?



          Originally Posted by David V View Post

          Besides the Amazon side of this (Bucket & Cloudfront), you'll really want a plugin on your site (If WordPress) to generate the expiring urls. You cannot do this manually without it being time consuming and a pain.
          It seems like you've done a lot to protect your links, but after all you've done in preventing people from putting your Amazon links on other sites and downloading your stuff, it still requires a plugin that generates expiring links?



          Originally Posted by David V View Post

          Use an Amazon "bucket ripper" to see if you can pull anything out of the bucket. It shouldn't work.
          A bucket ripper (or other names) is used by lower life forms to scan S3 buckets for assets and weaknesses.
          Thanks. I didn't know such a thing existed. In order to use a bucket ripper you still need to know the name of the S3 bucket, right? How difficult is that for someone to find? Is this a bucket ripper? Amazon S3 Ripper Online Tool by Internet Geeks
          {{ DiscussionBoard.errors[10555784].message }}
          • Profile picture of the author David V
            Originally Posted by magentawave View Post

            Thanks for taking the time to tell me about that stuff. I have a few questions when you get a chance, please.
            And adding Cloudfront does not instantly protect my S3 URL's, right? I'm asking because I thought I read somewhere that Cloudfront offers protection to S3 that having S3 alone doesn't.

            Right. It does not protect anything by default. You need to connect and add permission to the bucket to allow the cloudfront distribution to work. S3 and Cloudfront are differetn. S3 is for storage, Cloudfront is for distribution. S3 buckets are STATIC so streaming video for example is best served via Cloudfront since they can stream it. Yes you can play video from a S3 bucket, but your not actually "streaming" anything. Your progressively loading it. Minor difference but streaming allows a user to have chapters in the video and seek without the loading buffer issues.


            Does Cloudfront have a fixed monthly fee or is the cost based on usage like S3? Does turning Cloudfront "ON" work on ALL of your buckets in your S3 account or do you need to specify which buckets you want Cloudfront to work with?

            Based on usage like S3. Use the amazon calculator.
            You need to specify and allow cloudfront to use each bucket.

            And by "programming" you mean that I can specify what I want done in Bucket Explorer or Cloudberry Explorer like making my videos NOT play on other peoples sites and no downloading of my stuff and one of those programs will do it for me? Is Bucket Explorer and Cloudberry Explorer any different than free stuff like Cyberduck or S3 Fox?

            No. Not quite that newbie user friendly
            Example: Create and apply a bucket policy. Normally, you need to write/create it by hand than apply it manually. With the bucketexplorer or cloudberry you can generate the policy and have them apply it. You can create many and store them as templates. etc..
            Those 2 apps are far more advanced for amazon work than Cyberduck or S3 fox.


            And is the reason for making clean looking links so they are easy for you to identify later?

            Mostly personal preference. Also matches my website.

            It seems like you've done a lot to protect your links, but after all you've done in preventing people from putting your Amazon links on other sites and downloading your stuff, it still requires a plugin that generates expiring links?

            Yes. They are relatively inexpensive though. Even without the expiring links, you'd still have to be on my site and logged in, and have member access to the content to view them. Not as time consuming as it all sounds. I'd say on average it takes me about 3 hours to completely setup my buckets, cloudfront, cnames, and tie in the member area.

            Thanks. I didn't know such a thing existed. In order to use a bucket ripper you still need to know the name of the S3 bucket, right? How difficult is that for someone to find? Is this a bucket ripper?

            That's a simple example yes. I've bumped into far more complex ones that are more like robots that scour the net for insecure buckets.
            So depending on the tool, they may need to know the url, and may not.
            {{ DiscussionBoard.errors[10555841].message }}
            • Profile picture of the author magentawave
              Thanks again, David. I appreciate it.

              I just sent the message below to 6 different people on Fiverr that work with S3 and Cloudfront. I created a bucket with only a few videos and audio and if they can do ALL of the following for me then I know it will work for my membership site that has about 150 videos.

              Here's the message I sent...

              I have an S3 account with a bucket that has only 4 videos and 2 MP3's in it. I'm sending this same message to 6 different people on Fiverr so I can find someone to do the following...

              1) Turn on Cloudfront. (Again, I already have an S3 account.)

              2) Make it so the links for my Amazon videos and PDF's can NOT be copied and work on any other website but my own. In other words, if someone does a view source and copies my Amazon links and puts them on their website those links will NOT work.

              3) Make it so that anyone that copies my Amazon links will NOT be able to download my videos, PDF's, etc.

              4) After doing the above, test to make sure my videos will play on ALL browsers (Mac and Windows) and on ALL mobile devices (iOS and Android).

              Thank you.
              {{ DiscussionBoard.errors[10556010].message }}
              • Profile picture of the author David V
                Originally Posted by magentawave View Post

                Thanks again, David. I appreciate it.

                I just sent the message below to 6 different people on Fiverr that work with S3 and Cloudfront. I created a bucket with only a few videos and audio and if they can do ALL of the following for me then I know it will work for my membership site that has about 150 videos.
                If your hiring someone, make sure to create user credentials for them and you have that information ready to go.

                Creating Amazon IAM User Credentials.

                You cannot give anyone your admin access. They would literally have access to everything including your billing area.
                {{ DiscussionBoard.errors[10556132].message }}
                • Profile picture of the author magentawave
                  That was the one question I forgot to ask before so thanks!

                  Actually, I do have one more question, please. If I find someone that can set up the little "test" bucket the way I listed before, how difficult would it be for me to copy everything they did for the little bucket and do the same for my big bucket? When I say "copy" I mean to copy the bucket policy and permissions and also copy whatever they did to set up Cloudfront?



                  Originally Posted by David V View Post

                  If your hiring someone, make sure to create user credentials for them and you have that information ready to go.

                  Creating Amazon IAM User Credentials.

                  You cannot give anyone your admin access. They would literally have access to everything including your billing area.
                  {{ DiscussionBoard.errors[10556149].message }}
                  • Profile picture of the author David V
                    Originally Posted by magentawave View Post

                    That was the one question I forgot to ask before so thanks!

                    Actually, I do have one more question, please. If I find someone that can set up the little "test" bucket the way I listed before, how difficult would it be for me to copy everything they did for the little bucket and do the same for my big bucket? When I say "copy" I mean to copy the bucket policy and permissions and also copy whatever they did to set up Cloudfront?
                    I wouldn't say easy to copy.... but not difficult.
                    The process and order matters as well.

                    Analyze the ACL's, the Properties for the bucket, the Setup and Properties for the Cloudfront Distribution.

                    Even if someone does it for you, you'd understand it better if you do it by testing.
                    Create a test bucket and test distribution.

                    I'd simply lay it out step by step for you in detail but it would not be short at all.
                    As I mentioned earlier, an entire course could be created just on this subject. (maybe I will at some point...)
                    It's easy... but complex at the same time.
                    {{ DiscussionBoard.errors[10556165].message }}
  • Profile picture of the author magentawave
    I'm seeing articles and videos about masking your S3 links by creating a cname, etc. Does masking S3 URL's protect the URL's from being copied and played on someone else's site and also from being downloaded? Or does it merely mask them so hopefully people doing a view source code of the page the S3 links are on won't know they are S3 links?
    {{ DiscussionBoard.errors[10559197].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      I'm seeing articles and videos about masking your S3 links by creating a cname, etc. Does masking S3 URL's protect the URL's from being copied and played on someone else's site and also from being downloaded? Or does it merely mask them so hopefully people doing a view source code of the page the S3 links are on won't know they are S3 links?
      It simply masks or changes the url to look like your site, there's no protection.
      Viewing source code should really not be a concern, you can't prevent that.
      What happens when they try to use the link is what you can control.
      {{ DiscussionBoard.errors[10559203].message }}
      • Profile picture of the author magentawave
        David, I'm hoping you can help me with this, please.

        The permissions below enable an individual S3 video file to play on my site ONLY (good!) on a desktop/laptop browser but the video won’t play from my site on iOS or Android (bad!). (There is just a greyed out box where the video should be.)

        Grantee: Me - Open/Download - View Permissions - Edit Permissions
        Grantee: Any Authenticated AWS User - (no box is checked)

        This page https://app.zencoder.com/docs/guides...ios-and-mobile has different bucket policies that supposedly enable the videos to play on mobile devices. I chose the first one on that page: Universal Smartphone Profile.

        I tried the bucket policy below but when I click to save it says: "Invalid policy element - input"

        ORIGINAL BUCKET POLICY:

        Code:
        {
  "input": "s3://bucket-name/file-name.avi",
  "outputs": [
    {
      "url": "s3://output-bucket/output-file-name.mp4",
      "audio_bitrate": 128,
      "audio_sample_rate": 44100,
      "height": 320,
      "width": 480,
      "max_frame_rate": 30,
      "video_bitrate": 1500,
      "h264_level": 3
    }
  ]
}
        SAME BUCKET POLICY AFTER ADDING MY STUFF;

        Code:
        {
  "input": "s3://my-launch-content/1-plc-video.avi",
  "outputs": [
    {
      "url": "s3://my-launch-content/1-plc-video.mp4",
      "audio_bitrate": 128,
      "audio_sample_rate": 44100,
      "height": 320,
      "width": 480,
      "max_frame_rate": 30,
      "video_bitrate": 1500,
      "h264_level": 3
    }
  ]
}

        What I did:

        You can see that I added the name of my bucket where it says "bucket-name" as "my-launch-content" because "my-launch-content" is the name of the bucket. And then where it says "file-name" I added "1-plc-video" because "1-plc-video" is the name of the video file.

        However, in the second part where it says "output-bucket" and "output-file-name" I added the exact same stuff that I did before. Is that where I messed this up? If so, what should go where it says "output bucket" and "output file name"?

        I also tried changing the "avi" to "mp4" in the first part because it is an mp4 but I got the same error.

        Then I tried adding https://s3.amazonaws.com/my-launch-c...-plc-video.mp4 to both parts and then I also tried removing https:// from the first part and still the same error.

        Got any suggestions?

        Thanks again.
        {{ DiscussionBoard.errors[10561084].message }}
        • Profile picture of the author David V
          I took a quick look...
          Those are not bucket policies, they are for video encoding (XML, JSON).

          What have you done so far?
          Bucket, policies, IAM users, how are you playing on the site? (JWPlayer..etc..)

          If you havent' seen this yet, take a quick look. Amazon example policies.
          {{ DiscussionBoard.errors[10561110].message }}
  • Profile picture of the author magentawave
    It said "S3" and "bucket-name" in that code so I assumed it was an S3 bucket policy. I have seen the page you referred me to and tried some of the bucket policies there but best case scenario people can view the videos on my site only and they can't download anything, but nothing plays from my site on iOS and Android.

    The video uses JW Player on Optimizepress 2. I haven't added any IAM users and I don't have any bucket policies.

    I tried the bucket policy below from the page you suggested that is for restricting access to a specific http referrer and I got this error message after clicking save: "Policy could not be parsed as a valid JSON string"

    Code:
    {
  "Version":"2012-10-17",
  "Id":"https://www.MySite.com/",
  "Statement":[
    {
      "Sid":"Allow get requests originating from www.MySite.com/.”,
      "Effect":"Allow",
      "Principal":"*",
      "Action":"s3:GetObject",
      "Resource":"arn:aws:s3:::my-launch-content/*”,
      "Condition":{
        "StringLike":{"aws:Referer":["https://www.MySite.com/*","https://MySite.com/*"]}
      }
    }
  ]
}
    By the way, I tried it with http and https and get the same error when I try to save it.
    {{ DiscussionBoard.errors[10561143].message }}
    • Profile picture of the author David V
      This validates, I tested it.

      HTML Code:
      {
    "Version": "2012-10-17",
    "Id": "http referer policy example",
    "Statement": [
        {
            "Sid": "Allow get requests originating from www.mysite.com and mysite.com.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-launch-content/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://www.mysite.com/*",
                        "http://mysite.com/*"
                    ]
                }
            }
        }
    ]
}
      {{ DiscussionBoard.errors[10561156].message }}
  • Profile picture of the author magentawave
    And to reiterate the permissions...

    PERMISSIONS FOR BUCKET: (All are checked)
    Grantee: me - Open/Download - View Permissions - Edit Permissions


    PERMISSIONS FOR INDIVIDUAL FILE:
    Same
    {{ DiscussionBoard.errors[10561158].message }}
  • Profile picture of the author David V
    And here is an actual policy on one of my buckets..
    I changed the domain name and bucket name. Everything else is accurate.

    You see multiple domains since it includes the cnames (assets, media) as well as a cloudfront cname.

    NOTE: This has been Updated..

    HTML Code:
    {
    "Version": "2012-10-17",
    "Id": "http referer wpcodeking policy",
    "Statement": [
        {
            "Sid": "Allow get requests referred by www.mywebsite.com and mywebsite.com",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucketname/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://www.mywebsite.com/*",
                        "http://mywebsite.com/*"
                    ]
                }
            }
        }
    ]
}
    {{ DiscussionBoard.errors[10561163].message }}
    • Profile picture of the author magentawave
      Thanks. I got that bucket policy to save without an error and the video only plays on my site, which is what I want, but it won't play from my site on iOS and Android. Any suggestions?
      {{ DiscussionBoard.errors[10561171].message }}
      • Profile picture of the author David V
        This may? be related to the encoding or the player itself.
        Also check the Content-Type header (Inside amazon console or Cloudberry) and make sure that is correct.
        Mobile may need a fallback. You use JW Player, so I think they have fallback.
        It's tough to say without seeing this in person, so I'm speculating a little, but check your player settings. You may also need to have a fallback version with the right encoding, in the bucket.

        Not directly related... but you might read this S3 & JW Player article
        and this quick mobile related article over at JWPlayer.

        JW Player browser/device reference
        {{ DiscussionBoard.errors[10561183].message }}
  • Profile picture of the author magentawave
    I told you before that Optimizepress is using the JWPlayer but I just realized it is Flowplayer. Sorry about that. (but your link to the JWPlayer forum inspired me to start a thread at the Flowplayer forum.)

    I'm not sure this is relevant to the videos not playing from my site on iOS and Android, but while the page is still loading on my laptop, you can briefly see that it says this before the video player turns into a solid grey rectangle: "No video with supported format and MIME type found." Again, that is when the page loads on my laptop because I don't see that when it loads on iOS and Android.

    Is there something I should change in the CORS Configuration Editor that would make the videos still work on iOS and Android?

    Code:
    <CORSConfiguration>
    <CORSRule>
        <AllowedOrigin>*</AllowedOrigin>
        <AllowedMethod>GET</AllowedMethod>
        <MaxAgeSeconds>3000</MaxAgeSeconds>
        <AllowedHeader>Authorization</AllowedHeader>
    </CORSRule>
</CORSConfiguration>
    {{ DiscussionBoard.errors[10561433].message }}
  • Profile picture of the author magentawave
    By the way, I also tried using the exact same bucket policy you pasted above and with the permissions like this...

    Grantee: Me – Open/Download – View Permissions – Edit Permissions (all boxes checked)
    Grantee: Everyone – Open/Download (one box checked)


    ...the video does play on iOS and Android from my site, but the video also plays on a site that isn't on the "allow" list of sites in the bucket policy.

    Is there some shortcode I could add to the page in Optimizepress that would enable those videos to play on iOS and Android?


    Bottom line: both bucket policies do absolutely nothing to restrict the video from playing on other sites.
    {{ DiscussionBoard.errors[10561442].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      By the way, I also tried using the exact same bucket policy you pasted above and with the permissions like this...

      Grantee: Me - Open/Download - View Permissions - Edit Permissions (all boxes checked)
      Grantee: Everyone - Open/Download (one box checked)

      ...the video does play on iOS and Android from my site, but the video also plays on a site that isn't on the "allow" list of sites in the bucket policy.

      Is there some shortcode I could add to the page in Optimizepress that would enable those videos to play on iOS and Android?

      Bottom line: both bucket policies do absolutely nothing to restrict the video from playing on other sites.
      I suspect the no mobile playing has to do with the videos and the content-type.

      I'll create a step by step video for you and anyone else who wants to protect assets on their site.
      Should be able to do it within a day or so.
      {{ DiscussionBoard.errors[10562561].message }}
      • Profile picture of the author magentawave
        But the videos DO play on iOS and Android if the permissions are set to Everyone - Read. Change the bucket policy/permissions in a way that limits the video do playing on my site only and no downloading and they stop working on iOS and Android.

        I'm at an impasse now so that would be AWESOME if you created such a video! If your instructions won't work for me then I'll have to say "F it" to using Cloudfront and buy the $47 S3 Media Vault plugin.
        {{ DiscussionBoard.errors[10562579].message }}
        • Profile picture of the author magentawave
          By the way, here is the S3 Media Vault plugin that I'll probably buy if I can't protect my stuff with Cloudfront on: Wicked Cool Plugins | S3MediaVault Pro
          {{ DiscussionBoard.errors[10562588].message }}
        • Profile picture of the author David V
          Originally Posted by magentawave View Post

          But the videos DO play on iOS and Android if the permissions are set to Everyone - Read. Change the bucket policy/permissions in a way that limits the video do playing on my site only and no downloading and they stop working on iOS and Android.

          I'm at an impasse now so that would be AWESOME if you created such a video! If your instructions won't work for me then I'll have to say "F it" to using Cloudfront and buy the $47 S3 Media Vault plugin.
          How big is one of your videos? If it's not big, send me a copy and I'll take a look at it. (If so, PM me)
          I've never had a mobile playing issue...
          I'll include 2 test videos in the tutorial also.

          The S3 Media Vault plugin is a great plugin... But I don't think it works with Cloudfront (Could be wrong), and the source code is encrypted...
          I get it... but a turn off for me.

          Oh... almost forgot. You said "I'll have to say "F it" to using Cloudfront"... does this mean you are trying to use this through cloudfront? Or just from the S3 bucket?

          Edit:
          Are these videos (On your site) for a members area?
          Or... are they an ongoing thing for the site?

          I'd say if it's an ongoing thing, it would be easier and more efficient to use a plugin. That way you can generate expiring urls on the fly...
          If it's a member site where you have X amount of videos and they're not being added all the time, you could do it manually instead.
          {{ DiscussionBoard.errors[10562592].message }}
  • Profile picture of the author magentawave
    I will PM you a link to a test page on my site that has a video and pdf.

    I'm not using Cloudfront at all yet. You're right that S3 Media Vault does not work with Cloudfront which is why I might have to bail on using Cloudfront.

    The videos are for a series of launch videos that sell memberships to another site (Very similar to a typical Jeff Walker style launch). I don't care much that my launch videos are protected (although I would protect them if I could). What I'm concerned about is protecting all the videos and pdf's on the membership site. DAP will protect my stuff from non-members but once a member logs in then they could take my stuff. It's unlikely but ever since a piece of SH*T literally copied my entire site a couple years ago I am a bit paranoid about that happening again. As soon as I figure out how to protect everything with bucket policies, permissions or S3 Media Vault, then I will work like a madman to update the first couple weeks of the membership site content and then I'll start the internal launch to my list. Once the launch starts then I will return to updating the membership site until I'm done. I just don't want to start the launch to my list until I know absolutely for sure how I'm going to protect my stuff.

    By the way, if S3 Media Vault is supposed to prevent my videos from being played on other sites as well as protect everything from being downloaded, then what's the point of having expiring links?
    {{ DiscussionBoard.errors[10562613].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      I will PM you a link to a test page on my site that has a video and pdf.

      By the way, if S3 Media Vault is supposed to prevent my videos from being played on other sites as well as protect everything from being downloaded, then what's the point of having expiring links?
      Expiring links are useful. Allows the validity of the link to stop after a certain time. Not magical, but cuts down on some b.s.
      {{ DiscussionBoard.errors[10562702].message }}
  • Profile picture of the author David V
    As promised I've created a video tutorial for this on my blog.
    Also there's a pdf version and sample bucket policy you can download.


    How To Setup Amazon S3 With WordPress To Protect Your Videos, PDF's, and Zips
    {{ DiscussionBoard.errors[10564381].message }}
  • Profile picture of the author magentawave
    Thanks David, that looks great! I brought this up before but it was never resolved because I forgot about it when I reverted to using Amazons 2008 bucket policy...

    How come when I use the same bucket policy you used (and obviously after adding my stuff to it) I get an error message that says Policy could not be parsed as a valid JSON string after I click the Save button? I looked online to find out what that is supposed to mean and couldn't find anything or didn't know what they were talking about.

    Thanks

    EDIT: I went back to the older 2008-10-17 and it accepts that one.
    {{ DiscussionBoard.errors[10565809].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      Thanks David, that looks great! I brought this up before but it was never resolved because I forgot about it when I reverted to using Amazons 2008 bucket policy...

      How come when I use the same bucket policy you used (and obviously after adding my stuff to it) I get an error message that says Policy could not be parsed as a valid JSON string after I click the Save button? I looked online to find out what that is supposed to mean and couldn't find anything or didn't know what they were talking about.

      Thanks

      EDIT: I went back to the older 2008-10-17 and it accepts that one.
      Are your referring to the updated one in the tutorial?
      If so, I'll check/test it, fix it, and update it.

      Update: I checked the one in the tutorials and it works fine, so you must be talking about an earlier one.

      Also, something I failed to mention in the video. I tested the videos in various browsers, my ipad, and an android, and they played fine.
      {{ DiscussionBoard.errors[10565860].message }}
      • Profile picture of the author magentawave
        I was referring to the bucket policy below that you included in your tutorial. I tried that one before and got the same error then too. For some strange reason my S3 account doesn't like that one.

        Code:
        {
    "Version": "2012-10-17",
    "Id": "http referer wpcodeking policy",
    "Statement": [
        {
            "Sid": "Allow get requests referred by www.mywebsite.com and mywebsite.com",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucketname/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://www.mywebsite.com/*",
                        "http://mywebsite.com/*"
                    ]
                }
            }
        }
    ]
}
        {{ DiscussionBoard.errors[10565936].message }}
        • Profile picture of the author David V
          Yeah that's interesting. I just tested it again... works good.

          Not sure what to say about that. Double check for typos.

          As far as I know (They don't actually specify it), the "ID" should be unique, but doesn't have to be across all of Amazon (Like bucket names).

          They do specify NOT to use the 2008 version unless it's already in use on a present bucket.

          Can you paste, or PM me the actual text (After your changes) your pasting into the policy dialog? And also what your editing it with.
          {{ DiscussionBoard.errors[10566029].message }}
  • Profile picture of the author magentawave
    Hey David, THANK YOU so much for taking the time to put together that tutorial! It's almost too good to be true but it worked! My videos only play on my site. They play on iOS and Android. They won't play on any site buy my own and you can't download them. YAY!!! This is HUGE because you have no idea how much I have scoured the internet for the last two weeks trying a million different things with none of them working the way I needed! YOU are a man of your word too! Seriously. This is such a relief because now I can focus starting tomorrow morning on updating the content on my membership site so I'm a couple weeks ahead of my (soon to be) members and then finally do the internal launch to my list. THANK YOU!

    Just a couple quick questions whenever you get the chance.

    1) Do you think this will work with Cloudfront?

    2) If I was to stick with S3 for now, how much of a hassle would it be to turn on Cloudfront a little later? Would turning on Cloudfront later mean that I'd have to go in and make changes to all the individual videos or could it be changed in the Flowplayer global settings?

    3) And to confirm: You said do NOT use Server Side Encryption (AES-256) for any content that my members will be able to download. Correct?


    P.S. I tried to leave a comment at your blog but got an error message after I click the "submit" button. https://www.evernote.com/l/Ag4-XRLkH...M6R1J9acSN26QA
    {{ DiscussionBoard.errors[10566206].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post


      Just a couple quick questions whenever you get the chance.

      1) Do you think this will work with Cloudfront?

      2) If I was to stick with S3 for now, how much of a hassle would it be to turn on Cloudfront a little later? Would turning on Cloudfront later mean that I'd have to go in and make changes to all the individual videos or could it be changed in the Flowplayer global settings?

      3) And to confirm: You said do NOT use Server Side Encryption (AES-256) for any content that my members will be able to download. Correct?


      P.S. I tried to leave a comment at your blog but got an error message after I click the "submit" button. https://www.evernote.com/l/Ag4-XRLkH...M6R1J9acSN26QA

      Your welcome.

      1) With a few modifications

      2) You could create a CF distribution later. As far as that plugin... I can't say for sure without testing. I use my own custom plugin.
      And YES, you would have to change all the urls.
      They would be different. Something like "adfasd987f8.cloudfront" or add a cname and use your own url like "assets.mysite.com"

      3) Yes, correct. I tested it several times and the way I have it setup in the example, I'm using the "Download Monitor" plugin. When entering an S3 url in the field, it downloads it properly but it's still encrypted.
      There are other ways around that, but a little more complex.

      P.S. Sorry about that. I'll take a look and see what's happening.
      {{ DiscussionBoard.errors[10566240].message }}
  • Profile picture of the author David V
    magentawave, the comment form has been fixed.

    Appreciate you pointing that out!
    {{ DiscussionBoard.errors[10566281].message }}
  • Profile picture of the author magentawave
    David,

    1) Do mp3's audio files work across all platforms or should I offer another version in the same way that I'm offering both mp4 and webm for the videos?

    2) Should I click the "auto buffering" button in the video player settings with S3 and/or Cloudfront?

    3) Have you figured out how to do everything you did in your video when using Optimizepress? I'm asking because the video element in OP doesn't have an "Amazon Protected Content" box like the Flowplayer plugin does.

    Thanks
    {{ DiscussionBoard.errors[10567598].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      David,

      1) Do mp3's audio files work across all platforms or should I offer another version in the same way that I'm offering both mp4 and webm for the videos?

      2) Should I click the "auto buffering" button in the video player settings with S3 and/or Cloudfront?

      3) Have you figured out how to do everything you did in your video when using Optimizepress? I'm asking because the video element in OP doesn't have an "Amazon Protected Content" box like the Flowplayer plugin does.

      Thanks
      1) As far as I know... you should be ok with the mp3. I've never used only audio, so I can't say for sure.

      2) Optional. If you activate auto buffering the video will download and be ready to go. Many people select false, since there's no need to load the video unless someone clicks play. Activating this will also increase the bandwidth from amazon since it will download/buffer whether someone plays it or not.

      3) I wouldn't use the built in video element in OP. You must have an authenticated connection with the S3 media.
      {{ DiscussionBoard.errors[10567687].message }}
      • Profile picture of the author magentawave
        I am amazed at how HUGE webm files are compared to compressed mp4's. Have you figured out how to compress webm files on a Mac? I looked everywhere and the only thing I found is something called "Hybrid" but it doesn't want to download on to my computer.
        {{ DiscussionBoard.errors[10567935].message }}
        • Profile picture of the author David V
          Originally Posted by magentawave View Post

          I am amazed at how HUGE webm files are compared to compressed mp4's. Have you figured out how to compress webm files on a Mac? I looked everywhere and the only thing I found is something called "Hybrid" but it doesn't want to download on to my computer.
          If your on a Mac and want something free, than Handbrake is the way to go.
          I'm on a Mac as well. Most videos I create are edited in Adobe Premiere Pro and Adobe Media Encoder.
          For other stuff I use Handbrake and/or Xilisoft Ultimate Video Converter.
          {{ DiscussionBoard.errors[10567937].message }}
          • Profile picture of the author magentawave
            I use Handbrake all the time but I didn't see any settings in it for compressing webm files. I searched online for "compress webm with handbrake" and found nothing. If you say it's possible then I'll go check out the Handbrake forum.
            {{ DiscussionBoard.errors[10567952].message }}
            • Profile picture of the author David V
              Originally Posted by magentawave View Post

              I use Handbrake all the time but I didn't see any settings in it for compressing webm files. I searched online for "compress webm with handbrake" and found nothing. If you say it's possible then I'll go check out the Handbrake forum.
              You may want to check out the WebM project site. Lot's of info there.
              {{ DiscussionBoard.errors[10567965].message }}
              • Profile picture of the author magentawave
                Sorry about that but I got it figured out. It was easy. All I had to do was change the name and extension in Handbrake Destination box from mp4 to webm and it compressed it down from 101 MB (23 minute long video) to 42 MB in only two minutes which is waaaay faster than compressing mp4's.

                Thanks again.
                {{ DiscussionBoard.errors[10567968].message }}
                • Profile picture of the author David V
                  Originally Posted by magentawave View Post

                  Sorry about that but I got it figured out. It was easy. All I had to do was change the name and extension in Handbrake Destination box from mp4 to webm and it compressed it down from 101 MB (23 minute long video) to 42 MB in only two minutes which is waaaay faster than compressing mp4's.

                  Thanks again.
                  No problem.

                  Also, just so you know.... Miro is also popular for mac, although I haven't used it in awhile.
                  {{ DiscussionBoard.errors[10567970].message }}
  • Profile picture of the author magentawave
    When I use S3 Fox to upload files to the bucket it adds its own stuff to that files Metadata. You can see it here: https://www.evernote.com/l/Ag55KhKgT...Z-KXG_t2bPgKQA Is there any reason for me to keep that extra stuff or can I delete it?
    {{ DiscussionBoard.errors[10568095].message }}
    • Profile picture of the author David V
      Originally Posted by magentawave View Post

      When I use S3 Fox to upload files to the bucket it adds its own stuff to that files Metadata. You can see it here: https://www.evernote.com/l/Ag55KhKgT...Z-KXG_t2bPgKQA Is there any reason for me to keep that extra stuff or can I delete it?
      You can get rid of it.
      I would imagine they use the filesize and modification time for reference inside s3fox.
      It won't hurt anything even if you leave it.
      {{ DiscussionBoard.errors[10568112].message }}
  • Profile picture of the author magentawave
    Hey David, thanks again for all of your help before with protecting my S3 links. I was wondering if you knew how to increase the default expiration time that S3 puts on the links?
    {{ DiscussionBoard.errors[10631009].message }}
  • Profile picture of the author hassanbajwa
    I am Using Jwplayer in WordPress websites for .m3u8 stream file but this player is not working, i am using this on

    <embed type="application/x-shockwave-flash" src="http://www.listenfmradios.com/SWFPlayer.swf" width="303" height="20" id="mpl" name="mpl" quality="high" allowscriptaccess="always" allowfullscreen="false" flashvars="autostart=true&amp;duration=99999&amp;f ile=http://yayin34.canlitvlive.com/trt1/live.m3u8">
    Ecouter Radio En Direct and Ecouter Radio En Direct
    if some one have any idea about this them please share with me.??
    {{ DiscussionBoard.errors[10644936].message }}
    • Profile picture of the author magentawave
      Originally Posted by hassanbajwa View Post

      I am Using Jwplayer in WordPress websites for .m3u8 stream file but this player is not working, i am using this on

      <embed type="application/x-shockwave-flash" src="http://www.listenfmradios.com/SWFPlayer.swf" width="303" height="20" id="mpl" name="mpl" quality="high" allowscriptaccess="always" allowfullscreen="false" flashvars="autostart=true&amp;duration=99999&amp;f ile=http://yayin34.canlitvlive.com/trt1/live.m3u8">
      Ecouter Radio En Direct and Ecouter Radio En Direct
      if some one have any idea about this them please share with me.??
      Sorry but I don't know about that. I'm having problems right now with FV Player plugin not centering videos on pages built with Optimizepress.
      {{ DiscussionBoard.errors[10645304].message }}

Trending Topics