Serving Private Videos with Amazon S3

List of contents:

• Obtaining the AWS Access Keys
• Creating a New Bucket
  • Bucket Content Protection in FV Player Settings
• Uploading Videos to the Bucket
• Managing Access Permissions
• Troubleshooting with Video Checker

A simple guide to editing metadata of mp4 videos in Amazon S3 which do not have the proper MIME types:

• How to set correct mime-type on videos in Amazon S3

Obtaining the AWS Access Keys

1. First log in to your Amazon AWS account at https://console.aws.amazon.com, make sure you are on the same account where you Amazon S3 buckets are, and click IAM (Identity & Access Management) in the Services menu.
2. Once the IAM screen opens, go to Users > Add user:



3. Enter your IAM user name. Below you can select the access type of the new user. Select the Programmatic access:



4. Now you need to set the permissions for the new user. Click on the Attach existing policies directly icon. Our player needs to be able to read the video files from Amazon S3 service, therefore you will only need to select AmazonS3ReadOnlyAccess:


You will only need the AmazonS3ReadOnlyAccess policy

5. Next step will let you review the settings you chose in the previous steps and finally create the new user. After clicking the Create user button, you will see the final screen with the Access key ID and Secret access key. Once you leave this screen, you won't be able to get to the Secret access key ever again, so it's important to save it now.


You won't be able to get back to this screen again, so you better save the keys

6. Now you can also copy the Access and Secret access keys and paste them into FV Player's settings - namely to Settings > FV Player > Hosting tab > Amazon S3 Protected Content. You will also need Amazon bucket name and the location of your bucket which we will create in the next section of this guide:

   

7. Paste the copied access keys into the corresponding fields of Amazon S3 Protected Content section and click Save All Changes.

That's it. Now the access keys can be used to play private videos from your Amazon S3 account.

Creating a New Bucket

1. First, log in to your Amazon AWS account. Then go to Services > Storage and select S3. 
2. Now you can create a new bucket by clicking on the Create Bucket button



3. Define your unique bucket name and select  the Region based on your location or location nearest to it. Then click Next.

   

4. The second step is for setting the properties of the bucket, namely Versioning, Logging and Tags. These are not necessary to set right now, so you can skip to the next step. You can always set these later.

5. In this step you can set the access permissions. The most important setting here is the Manage public permissions (you can leave the rest in the default setting).
   That will allow you to choose if you want to not grant public read access to your bucket (default) and protect the content, or make it open. You can read more about this in the Managing Access Permissions part of this guide.

   

6. Last step will show you the review of your previous settings. If all is ok, you can click on the Create bucket button.

Bucket Content Protection in FV Player Settings

1. If you are interested in file protection, also enter the bucket name an its location into Amazon Bucket and Region fields at Settings > FV Player > Hosting tab > Amazon S3 Protected Content. Obtaining the access keys is described in the previous part of this guide.

   

2. There is also the Default Expiration Time field. When you post your video, FV Player checks its length and makes sure the link expiration time is big enough for the video to be loaded to the buffer properly. If the check fails, the value of Default Expire Time field is taken into account. You can also force the time you set by turning on the Force the default expiration time option.

3.  If you use a WordPress caching plugin:

4. Make sure you set the Default Expire Time to twice as much as your cache timeout and check Force the default expiration time checkbox. Otherwise the video source URLs in the cached HTML will expire and the videos won't be playable. This way the video duration won't be used for calculation of expiry time.

5. If you use the protected Amazon S3 videos only for your membership section, make sure the cache plugin is turned off for logged in users :
   • If you use Hyper Cache, it already excludes logged in members from cache (read why we recommend Hyper Cache over other plugins)
   • If you use WP Super Cache, turn on Settings > WP Super Cache > Advanced > Don’t cache pages for known users.
   • If you use W3 Total Cache, make sure Performance > Page Cache > Don't cache pages for logged in users is on
   • If you use other plugin, you should be able to find this settings as well.

Uploading Videos to the Bucket

1. Once your bucket opens, you will see there are no files yet. Click on the Upload button to proceed.

   

2. Click Add Files to pick the desired video files from your computer (or drag and drop them in the respective area). You can select as many files as you want and add them from different folders with the + Add more files button. Then click Next.

   

   • Important note: The names of your files and folders shouldn't contain spaces. S3 will convert the spaces to "+" symbols and links with these symbols may cause some trouble on certain mobile devices (for instance iOS devices). Use "-" instead spaces, for example "my-test-video.mp4", instead of "my test video.mp4".
   • Naming scheme: S3 recommends naming files using only letters, numbers, underscores and dashes. And folders using lowercase letters, numbers, dots and dashes (NO underscores front or back slashes). Improper naming will cause video issues and no video will be displayed.
3. In the next step you can set the permissions. Set the same option you selected in step 5 of the Creating a New Bucket part of this guide and proceed to the next step.
4. Now you can edit the Storage class, Encryption and Metadata (also known as Mime type). The first two are not important for our purposes, but setting the correct metadata is a very important part of this process, that will ensure maximum video compatibility. Click in the empty Header field (labeled as Select a header...) and select Content-Type. The value you enter in the value field depends on what video format are you uploading. Here are the correct content type values for various file extensions. It should definitely not be application/octet-stream:
   

   .mp4 video/mp4
   .webm video/webm
   .ogv video/ogg
   .m4v video/x-m4v

   After entering the correct value, you can click on the Save button and then move to the next step.

   

5. Last step is a review of your previous settings. If everything is ok, then click on the Upload button. A progress bar will appear at the bottom of the page and you will be able to see the videos appearing in the bucket once they are uploaded.

   

6. Now click on the video you want to post on your website with FV Player. You will see it's properties and most importantly the URL. Copy the URL (you can use the Copy path button).

   

   You can now paste it into the Video field of FV Player shortcode editor or into [fvplayer] shortcode in src="" parameter. See the basic video posting guide if you need help.

Managing Access Permissions

Next steps will illustrate how to set permissions for an individual video, but these settings can as well be applied to a whole bucket.

1. To make the video accessible to everyone, click on the video in your bucket to access it's settings and open the Permissions section. Go to Public access section and select Everyone from the list. A new window will appear on the right side of the screen, where you can select the Read object option in Access to the object part. Click Save afterwards.



2. If you are interested in the file protection, make sure only your account is present in the list of permissions and it has all the access. Obtaining the access keys required for playback of private files is described in the Obtaining the AWS Access Keys section of this document.

   

Troubleshooting with Video Checker

The Video Checker is a built-in feature that is used for detecting issues with the source video. It generates an overview of the video's encoding settings and also shows suggestions on what should be changed if there is something wrong. You can read more about this feature in the guide How to Use the Built-in Video Checker.

Here are a few tips that will help you to resolve some common video playback issues:

1. If the video doesn't play, make sure you check it out when you are logged in as admin. You will notice a message in the top left corner of the video. If it's green and says "Video OK", it means our video checker found no issues.

   Note: If you don't see any message then double check that Disable admin video checker is not selected at Settings > FV Player > Sitewide Flowplayer Defaults.

   
   FV Player - Admin Video Checker

2. Clicking on that error reveals error details.

   
   FV Player - Admin Video Checker - Details

   • Access to video forbidden (HTTP 403) - it means that your video file is private and there are no keys for the bucket the video is supposed to be read from. Therefore you need to:
     
     • make sure you set up the access keys (steps no. 1 - 11).
     • if you already have the access keys, make the video public (step no. 22), and rename the Amazon Bucket in step no. 16 temporarily to disable the URL signature, and try to play the video again. If it works, then the access keys are invalid or the IAM user is not set properly (steps no. 7 - 10)
   • The AWS Access Key ID you provided does not exist in our records - it means that you provided wrong access key. To obtain proper access key, refer to Obtain your Amazon AWS access credentials part of this guide.
   • We recommend that you check this guide step-by-step to find the cause of the issue.
   • Also do some basic troubleshooting:
     • is there any Policy attached to the bucket? If you are limiting access by HTTP referer, the videos won't play on Android stock browser
     • is my file or folder in a bucket named correctly?
     • try setting up a new key pair for your IAM user - perhaps you just failed to copy the key properly. Refer to Obtain your Amazon AWS access credentials part of this document
     • try setting up a new IAM user altogether - are you using the same AWS account which has the S3 bucket you defined in step no. 17 of this guide?
     • try to setup a new Amazon S3 bucket and start with public permissions

3. If the video checker says "Admin: Video OK", then your setup is correct, and the video plays correctly! The video URL is visible in the page HTML, but it's only valid for a short time (depending on your Default Expiry Time setting or the video length), so the video can't be linked from other (unauthorized) websites.