Serving Private Videos with Amazon S3

This article shows you how to:

• Obtain your Amazon AWS access credentials
• Upload files with a proper mime type and set permissions for both public and private access

A simple guide to editing metadata of mp4 videos in Amazon S3 which do not have the proper MIME types:

• How to set correct mime-type on videos in Amazon S3

Obtaining the Amazon AWS access credentials

Skip to next section (step 13.) if you do not want to protect your video against unauthorized downloads.

1. First log in to your Amazon AWS account at https://console.aws.amazon.com, make sure you are on the same account where you Amazon S3 buckets are, and click Identity & Access Management (IAM) in the menu:

   
   Amazon AWS Menu

2. Once the IAM screen opens, go to Users > Create New Users:

   
   Creating new user in IAM

3. Enter your IAM user name, make sure Generate an access key for each user is on and click Create:

   
   Creating new user in IAM

4. Once the user is created, you will see a confirmation window. Click Show User Security Credentials to reveal the Access Key ID and Secret Access Key:

   
   Be careful to copy the access keys

5. Copy these keys and navigate to Settings > FV Player > Hosting > Amazon S3 Protected Content inside your WordPress admin panel. You will also need Amazon bucket name and the location of your bucket which we will create in the next section of this guide:

   

6. Paste the copied access keys into the corresponding fields of Amazon S3 Protected Content section and click Save All Changes.
7. Now that you have stored the keys, you can go back to your Create User dialog and click Close or click Download Credentials to store the access keys in a text file on the hard drive of your computer. If you click Close, a confirmation window shows up warning you that it is very important you store those credentials, as you will not be able to get them later. If you lost these access keys, you would have to create a new set of access keys for the particular user.
   

   You will not get these credentials of Amazon again!

8. Last step is to make sure your IAM user has read-only access to the files only. Once you close the above window, look up the user in the list, click its name, select the Permissions tab and click Attach Policy:

   
   Attaching User Policy

9. Our player needs to be able to read the video files from Amazon S3 service, therefore select AmazonS3ReadOnlyAccess only:

   
   Select Policy Template

10. Confirm the chosen policy by clicking Attach Policy
11. This is what you will see afterward in the Permissions tab:

    
    Amazon IAM User Permissions in effect

That's it. Now the access keys can be used to play private videos from your Amazon S3 account.

Uploading the files and setting their properties

There are tools which allow you to upload these files without using the web browser, but for smaller number of files you can just use the web interface:

12. First, log in to your Amazon AWS account at https://console.aws.amazon.com/, and click S3 in the menu:

    
    S3 in Amazon AWS Menu

13. Next, you have to create your first bucket where you put your videos, click Create Bucket:

    
    Create your first bucket

14. Define your unique bucket name, select your location or location nearest to it,  and click Create:

    
    Enter the bucket name and hit Create

15. Once the bucket is created, click its name to open it to upload your video files:

    
    List of your Amazon S3 buckets

16. If you are interested in file protection, also enter the bucket name an its location into Amazon Bucket and Region fields at Settings > FV Player > Hosting > Amazon S3 Protected Content.  Obtaining the access keys is described in the Obtaining the Amazon AWS access credentials section of this document.

    

    There is also the Default Expiration Time field. When you post your video, FV Player checks its length and makes sure the link expiration time is big enough for the video to be loaded to the buffer properly. If the check fails, the value of Default Expire Time field is taken into account.

17. If you use a WordPress caching plugin:

    Make sure you set the Default Expire Time to twice as much as your cache timeout and check Force the default expiration time checkbox. Otherwise the video source URLs in the cached HTML will expire and the videos won't be playable. This way the video duration won't be used for calculation of expiry time.

18. If you use the protected Amazon S3 videos only for your membership section, make sure the cache plugin is turned off for logged in users :
    • If you use Hyper Cache, it already excludes logged in members from cache (read why we recommend Hyper Cache over other plugins)
    • If you use WP Super Cache, turn on Settings > WP Super Cache > Advanced > Don’t cache pages for known users.
    • If you use W3 Total Cache, make sure Performance > Page Cache > Don't cache pages for logged in users is on
    • If you use other plugin, you should be able to find this settings as well.

19. Once your bucket opens, you will see there are no files yet. You need to click Upload:

    
    Upload files

20. Click Add Files to pick the desired video files from your computer, and then click Start Upload.
    

    • Important note: The names of your files and folders shouldn't contain spaces. S3 will convert the spaces to "+" symbols and links with these symbols may cause some trouble on certain devices (for instance iOS). Use "-" instead spaces, for example "my-test-video.mp4", instead of "my test video.mp4".

    
    Start uploading the files

21. The files starts uploading, you will see a progress bar:

    
    File uploading...

    
    File successfully uploaded!

22. Once the file is uploaded, you will see it in the bucket. Click its name and then open its properties:

    
    Checking file properties

23. In the Properties pane, you can see the video URL (Link field) and various file properties:

    
    Amazon S3 File Properties

    Copy that URL, you will paste it into the Video field of FV Player video editor or into [fvplayer] shortcode. See the basic video posting guide.

24. To make the video accessible to everyone, open the Permissions section and make sure Everyone is allowed to download and view the file. If it's not so, you can add Everyone by clicking Add more permissions, select Everyone from the list box, and select both Open/Download and View Permissions options. Click Save.

25. If you are interested in the file protection, make sure only your account is present in the list of permissions and it has all the access. Obtaining the access keys required for playback of private files is described in the Obtaining the Amazon AWS access credentials section of this document.

    
    Private File Permissions

26. Last step, double check that the file has proper Mime type (content type) set in the Metadata tab. This ensures maximum video compatibility. Here are the correct Content-Types (mime types) for various file extensions. It should definitely not be application/octet-stream:

    .mp4 video/mp4
    .webm video/webm
    .ogv video/ogg
    .m4v video/x-m4v

    
    Changing Mime type of a file

    In case your Mime type is not set up properly, please follow our guide.

27. If the video doesn't play, make sure you check it out when you are logged in as admin. You will notice a message in the top left corner of the video. If it's green and says "Video OK", it means our video checker found no issues.

    If you don't see any message then double check that Disable admin video checker is not selected at Settings > FV Player > Sitewide Flowplayer Defaults.

    
    FV Player - Admin Video Checker

28. Clicking that error reveals error details.

    
    FV Player - Admin Video Checker - Details

    • Access to video forbidden (HTTP 403) - it means that your video file is private and there are no keys for the bucket the video is supposed to be read from. Therefore you need to:
      
      • make sure you set up the access keys (steps no. 1 - 11).
      • if you already have the access keys, make the video public (step no. 22), and rename the Amazon Bucket in step no. 16 temporarily to disable the URL signature, and try to play the video again. If it works, then the access keys are invalid or the IAM user is not set properly (steps no. 7 - 10)
    • The AWS Access Key ID you provided does not exist in our records - it means that you provided wrong access key. To obtain proper access key, refer to Obtain your Amazon AWS access credentials part of this guide.
    • We recommend that you check this guide step-by-step to find the cause of the issue.
    • Also do some basic troubleshooting:
      • is there any Policy attached to the bucket? If you are limiting access by HTTP referer, the videos won't play on Android stock browser
      • try setting up a new key pair for your IAM user - perhaps you just failed to copy the key properly. Refer to Obtain your Amazon AWS access credentials part of this document
      • try setting up a new IAM user altogether - are you using the same AWS account which has the S3 bucket you defined in step no. 17 of this guide?
      • try to setup a new Amazon S3 bucket and start with public permissions

29. If the video checker says "Admin: Video OK", then your setup is correct, and the video plays correctly! The video URL is visible in the page HTML, but it's only valid for a short time (depending on your Default Expiry Time setting or the video length), so the video can't be linked from other (unauthorized) websites.