AWS MediaConvert Encrypted HLS Guide

MediaConvert is the new Amazon Web Service for video encoding which replaces the old Elastic Transcoder. It has a better pricing model where you only pay for the encoding features which you are actually using, and it supports all the new standards, such as 4K video

Before you begin

We assume that:

1. You know the basics of the FV Player usage. You can check it here: FV Player Start-up Guide

2. You have working Amazon S3 + Cloudfront setup according to the Serving Private Videos via CloudFront guide (Note: please be aware of the fact that every step regarding download protection or privacy, needs to be skipped)

IAM User Role

Before you start using MediaConvert, you need to create the IAM Role which you will use it with.

1. Start by opening Services -> IAM ->Roles -> Create role.

 

Creating roles in IAM

 

2. Pick the MediaConvert service and then just keep hitting "Next", three times.

 

 

3. In the last step of the Create role wizard, you need to provide the name of the new role. Just enter "MediaConvert".

 

 

Now it's time to create your first video encoding job. Click "Create role".

Creating a new MediaConvert video encoding job

We assume that you have an S3 bucket in place to which you already uploaded your video in an MP4 format. Always use the highest quality version of your video, otherwise the video encoding process might degrade the quality too much.

4. Open Services -> MediaConvert and click "Get started".

 

 

5. You will get to a screen which outlines the whole process on the left hand side, and lets you edit all the properties on the right hand side. Make sure you are in the "Input 1" section and click the "Browse" button.

Input section of Creating a job

6. Use the popup dialog to pick your S3 bucket and the input file. Once your file is selected click "Choose".

7. Now you need to add the Output group, so click the "Add" button, next to it.

Adding output group

8. Use the popup to pick "Apple HLS". Click "Select".

If you are interested in H.265 video codec pick the "CMAF" output and then select "Segment Control -> Segmented Files" and you can disable "Write DASH manifest" too.

 

 

9. You will get to the "Apple HLS" section where you need to click "Browse" to specify the output location.  

Apple HLS group settings 

10. Use the popup dialog to pick your S3 bucket and enter the location path. You have to use the forward slash in order to put it all into a new folder, and then also enter a filename - without the extension. So if you have multiple courses where each course consists of multiple lessons you can works with a structure like this:

Course-01/Lessons-01/index

You can browse through your existing folders too. Once you are done click "Choose".

 

 

11. Now that your destination is set, you need to add all the outputs. Click "Output 1" to enter information about the desired video output.

 

Adding outputs

 

12. Pick the "Preset" and enter the "Name modifier".

Just make sure what you pick matches your video aspect ratio, frame rate, and resolution. So, for a Full HD video start by picking "System-Avc_16x9_1080p_29_97fps_8500kbps" and enter "-1080p" as the Name modifier.

 

 

13. Now, click on Output Groups -> "Apple HLS" to go back to that section, and click "Add output" to add another quality.

 

Adding another quality

14. "Output 2" will be displayed. Click on it and repeat steps 12. and 13. until you have set all the qualities you need. We recommend using the following setup:

• Output 1: System-Avc_16x9_1080p_29_97fps_8500kbps with Name modifier -1080p
• Output 2: System-Avc_16x9_720p_29_97fps_5000kbps with Name modifier -720p
• Output 3: System-Avc_16x9_540p_29_97fps_3500kbps with Name modifier -540p
• Output 4: System-Avc_16x9_360p_29_97fps_1200kbps with Name modifier -360p
• Output 5: System-Avc_16x9_270p_14_99fps_400kbps with Name modifier -270p

Just make sure what you pick matches your video aspect ratio, frame rate, and resolution.

15. To really protect your video from downloading, you also need to encrypt the HLS stream. 1. Click "Apple HLS", then 2. click "DRM encryption".

If you don't need to encrypt your video, you can skip to step 17.

 

 

(Please fill your own info into parts of the text marked with red)

 

16. In the DRM box, select the following properties:

• 3. Encryption method: AES-128
• 4. Key provider type: Static Key
• 5. Static key value: enter a random hex encoded 16 byte string, you can use this tool to get it:

• 6. URL: It's important to get this one right otherwise the video won't play. The format of that URL is:

  https://your-wordpress-site.com/?fv_player_hls_key={Location from step 10.}

  If your website is using https:// then this URL needs to use https:// as well. If your website is using a domain with www. in front of it, make sure it's included as well.

  Example:

  In this guide, our location was set to MediaConvertTest/index and our WordPress site is https://foliovision.com so the URL for the Static key will be:

  https://foliovision.com/?fv_player_hls_key=MediaConvertTest/index       

 

 

17. Then go to Job Settings -> Settings, and pick your IAM role. 

18. Scroll down to the very bottom and click "Create".

 

 

19. You will see that your job has been submitted. You can click the "Refresh" button to see if it's done yet.

20. Once it's done, you can access the folder with the encoded stream using the link in the "Outputs" section.

File permissions

21. To make the new stream playable, you need to either:

• Make sure you are using a CloudFront distribution with your S3 bucket. The guide for that is here. Keep in mind that:
  
  • You should not use the "Restrict Viewer Access" option (signed URLs won't work with HLS stream)
  • You will need to check the "Restrict Bucket Access" along with the "Grant Read Permissions on Bucket"
• Fix the file permissions to make your HLS stream file is publicly accessible.

This is due to the fact that a m3u8 HLS file is static and cannot always include the most up-to-date URL signatures as these are time sensitive.

In case you are using CloudFront, you can skip to step 23.

The stream file permissions need to be fixed in the S3 bucket. First locate the folder in the S3 bucket, right click it and select "Make public".

 

Changing stream file premission

 

22. You will be asked to confirm your action in a popup box.

 

 

Posting the video to your website

23. To insert and play your encrypted HLS stream, make sure you are using FV Player Pro Beta. Here's how to switch to it: Switching FV Player Pro to Beta

This guide and the whole process is new, we will of course make it part of the stable version of FV Player Pro soon. But for now it's in Beta.

24. Bring up the FV Player editor and:

• Enter the video URL into the shortcode editor. You can get the file path from the S3 bucket which gives you something like:

  https://s3-eu-west-1.amazonaws.com/{bucket name}/MediaConvertTest/index.m3u8

  If you use CloudFront, you will need to replace the bucket path with your CloudFront URL, so it ends up being like this:

  https://{CloudFront domain ID}.cloudfront.net/MediaConvertTest/index.m3u8

  Note that you can also used the FV Player S3 Browser feature, if you have your S3 bucket access keys set in FV Player -> Hosting -> Amazon S3. That way the URL will automatically use the proper CloudFront URL if it's set up.
  

• Paste in the "Static key value" from Step 16. into the Encryption HLS field. Or you can get it from the "Job summary" screen, just go to Details -> Apple HLS -> "DRM encryption"
• Click "Insert" to save the player
• Save your post and test the video