Serving Private Videos with Amazon S3

List of contents:

• Obtaining the AWS Access Keys
• Creating a New Bucket
  • Bucket Content Protection in FV Player Settings
• Uploading Videos to the Bucket
• Managing Access Permissions
• Troubleshooting with Video Checker

A simple guide to editing metadata of mp4 videos in Amazon S3 which do not have the proper MIME types:

• How to set correct mime-type on videos in Amazon S3

Obtaining the AWS Access Keys

1. First, log in to your Amazon AWS account at https://console.aws.amazon.com, make sure you are on the same account where your Amazon S3 buckets are, and click IAM (Identity & Access Management) in the Services menu.
2. Once the IAM screen opens, go to Users > Add user:



3. Enter your IAM user name. You can select the access type of the new user below. Select the Programmatic access, then click Next: Permissions.



4. Now you need to set the permissions for the new user. Click on the “Attach existing policies directly” icon and pick AmazonS3ReadOnlyAccess and CloudFrontReadOnlyAccess. Scroll to find it. Click Next: Tags.


Setting premissions for new user

 

5. The next screen is for adding tags. It’s optional, you can add them if you wish. Click Next: Review. At the review screen, click the Create user button. This will take you to the final screen with the Access key ID and Secret access key. Once you leave this screen, you won’t be able to get to the Secret access key again, so it’s important to save it now. Click Download .csv.

 

 


Obtaining the Access and Secret keys

 

6. Now you can also copy the Access and Secret access keys and paste them into FV Player’s settings – namely to Settings > FV Player > Hosting tab > Amazon S3 Protected Content. You will also need an Amazon bucket name and the location of your bucket, which we will create in the next section of this guide.
   

    

    


Pasting access keys into FV Player settings

7. Paste the copied access keys into the corresponding fields of the Amazon S3 Protected Content section and click Save All Changes.

That’s it. Now the access keys can be used to play private videos from your Amazon S3 account.

Creating a New Bucket

1. First, log in to your Amazon AWS account. Then go to Services > Storage and select S3. 
2. Now you can create a new bucket by clicking on the Create bucket button


Creating an Amazon S3 bucket

3. Define your unique bucket name and select the Region, based on your location or the location nearest to you. Then click Next.

   
   Bucket name and region

4. The second step is setting the access permissions. The most important settings here are the Public access settings. (you can leave the rest in the default setting)

   That will allow you to choose if you do not want to grant public read access to your bucket (default) and protect the content, or, if you want to make it open. You can read more about this in the Managing Access Permissions part of this guide. 


Setting premissions for bucket

5. The next step is setting the properties of the bucket, namely Versioning, Logging, Tags and default encryption. These are not necessary to set right now, so you can skip to the next step. You can always set these later. 

6. Last step will show you the review of your previous settings. If all is okay, you can click on the Create bucket button.

Bucket Content Protection in FV Player Settings

1. If you are interested in file protection, also enter the bucket name and its location into Amazon Bucket and Region fields at Settings > FV Player > Hosting tab > Amazon S3 Protected Content. Obtaining the access keys is described in the previous part of this guide.

    

    

   
   Bucket name and region in FV Player’s settings

    

    

2. Here you can also see the Default Expiration Time field. When you post your video, FV Player checks its length and makes sure the link expiration time is big enough for the video to be loaded into the buffer properly. If the check fails, the value of the Default Expiration Time field is taken into account. You can also force the time you set by turning on the Force the default expiration time option.

3.  If you use a WordPress caching plugin, Make sure you set the Default Expiration Time to twice as much as your cache timeout, and check Force the default expiration time checkbox. Otherwise the video source URL’s in the cached HTML will expire and the videos won’t be playable. This way the video duration won’t be used for calculation of expiry time.
4. If you use the protected Amazon S3 videos only for your membership section, make sure the cache plugin is turned off for logged in users :
   • If you use Hyper Cache, it already excludes logged in members from cache (read why we recommend Hyper Cache over other plugins)
   • If you use WP Super Cache, turn on Settings > WP Super Cache > Advanced > Don’t cache pages for known users.
   • If you use W3 Total Cache, make sure Performance > Page Cache > Don’t cache pages for logged in users is turned on
   • If you use other plugins, you should be able to find this setting as well.

Uploading Videos to the Bucket

1. Open your bucket by clicking it. You will see there are no files yet. Click on the Upload button.

    

   
   Uploading files to the bucket

    

2. Click Add Files to pick the desired video files from your computer (or drag and drop them in the respective area). You can select as many files as you want and add them from different folders, just click Add Files again. Then click Next.

    

   

    

   • Important note: The names of your files and folders shouldn’t contain spaces. S3 will convert the spaces to “+” symbols and links with these symbols may cause some trouble on certain mobile devices (for instance iOS devices). Use “-” instead of spaces, for example “my-test-video.mp4”, instead of “my test video.mp4”.
   • Naming scheme: S3 recommends naming files using only letters, numbers, underscores and dashes. And folders using lowercase letters, numbers, dots and dashes (NO underscores front or back slashes). Improper naming will cause video issues and no video will be displayed.
3. The next step is to set the permissions. Set the same option you selected in step 5 of the Creating a New Bucket part of this guide and proceed to the next step.
4. Now you can edit the Storage class, Encryption and Metadata (also known as Mime type). The first two are not important for the purposes of this guide, but setting the correct metadata is a very important part of this process. It will ensure the maximum video compatibility. Scroll down to the Metadata section. In Type field select System defined, and in Key select Content-Type. The value you write in the value field depends on what video format you are uploading. Here are the correct content type values for various file extensions. It should definitely not be application/octet-stream:
   

   .mp4 video/mp4
   .webm video/webm
   .ogv video/ogg
   .m4v video/x-m4v

   After putting in the correct value, you can click on the Save button and then move on to the next step.

   
   Setting bucket metadata

5.  If everything is okay, click the Upload button. You will be taken to an upload status page. You will be able to see the videos appearing in the bucket once they are uploaded.

6. Now click on the video you want to post on your website with FV Player. Copy the Object URL.

   

    

    

   You can now paste it into the Video field of the FV Player shortcode editor or into [fvplayer] shortcode in src=”” parameter. See the basic video posting guide if you need help.

Managing Access Permissions

The next steps will illustrate how to set the permissions for an individual video, but these settings can also be applied to the whole bucket.

1. To make the video accessible to everyone, click on the video in your bucket to access it’s settings, and select the Permissions tab, and click Edit.


Editing access permissions

2. On the Edit access control list, enable Read permission for Everyone. Confirm your choice by checking the warning box. Then click Save Changes. 

 


Editing access permissions

 

3. If you are interested in file protection, make sure only your account is present in the list of permissions and it has all the access. Obtaining the access keys required for playback of private files is described in the Obtaining the AWS Access Keys section of this document.

Troubleshooting with Video Checker

The Video Checker is a built-in feature that is used for detecting issues with the source video. It generates an overview of the video’s encoding settings, and if there is something wrong, then it also shows suggestions on what should be changed. You can read more about this feature in the guide How to Use the Built-in Video Checker.

Here are a few tips that will help you resolving some common video playback issues:

1. If the video doesn’t play, make sure you view it while you are logged in as admin. You will notice a message in the top left corner of the video. If it’s green and says “Video OK“, it means our video checker found no issues.

   Note: If you don’t see any message then double check that Disable admin video checker is not selected at Settings > FV Player > Sitewide FV Player Defaults.

   
   FV Player – Admin Video Checker

2. Clicking on the error message reveals the error details.

   
   FV Player – Admin Video Checker – Details

   • Access to video forbidden (HTTP 403) – it means that your video file is private and there are no keys for the bucket the video is supposed to be read from. Therefore you need to:
     • make sure you set up the access keys.
     • if you already have the access keys, make the video public, and rename the Amazon Bucket temporarily, to disable the URL signature, and try to play the video again. If it works, then the access keys are invalid or the IAM user is not set properly
   • The AWS Access Key ID you provided does not exist in our records – it means that you provided the wrong access key. To obtain the proper access key, refer to the Obtain your Amazon AWS access credentials part of this guide.
   • We recommend that you check this guide step-by-step to find the cause of the issue.
   • Also do some basic troubleshooting:
     • is there any Policy attached to the bucket? If you are limiting access by HTTP referrer, the videos won’t play on Androids browser
     • is my file or folder in a bucket named correctly?
     • try setting up a new key pair for your IAM user – perhaps you just failed to copy the key properly. Refer to the Obtain your Amazon AWS access credentials part of this document.
     • try setting up a new IAM user altogether – are you using the same AWS account which has the S3 bucket you defined in step no. 17 of this guide?
     • try to setup a new Amazon S3 bucket and start with public permissions

3. If the video checker says “Admin: Video OK“, then your setup is correct, and the video plays correctly! The video URL is visible in the page HTML, but it’s only valid for a short time (depending on your Default Expiry Time setting or the video length), so the video can’t be linked from other (unauthorized) websites.