Edge Video Streaming Setup Guide for AWS

Learn how to set up secure and efficient video streaming from your AWS environment to the Vionlabs platform.

The Vionlabs Edge Video Streaming Setup Guide provides step-by-step instructions for configuring secure and efficient video delivery from your AWS environment to the Vionlabs platform. It outlines how to apply IAM permissions and set up CORS for your video storage - ensuring controlled access and optimized streaming performance.

This guide is intended for system administrators or technical engineers responsible for enabling video ingestion and playback within customer-managed cloud environments. Following the outlined steps will help you establish a compliant, secure integration between your AWS video bucket and the Vionlabs portal.

For best results, verify your IAM role configuration, test access from your portal environment, and monitor S3 access logs as recommended in the Best Practices and Troubleshooting section below.

Introduction

This guide provides step-by-step instructions for end-customers to set up Edge Video Streaming on AWS infrastructure. It covers the two high-level steps required: applying IAM policies and configuring CORS for the video bucket. This setup ensures secure and efficient video streaming from your AWS environment to the portal.

Prerequisites:

• Access to the AWS Management Console or AWS CLI with appropriate permissions.
• An existing S3 bucket for videos (referred to as YOUR_VIDEO_BUCKET_NAME throughout this guide, without the s3:// prefix).
• AWS CLI installed and configured with credentials for your target environment.
• For IAM roles involving AWS-GCP federation, consult your administrator for federation details.

The guide is structured into 2 main steps. Follow them in order.

Overview of Setup Steps

01 - Apply IAM Permissions
Give your system the right access to manage videos.

02 - Set Up CORS for Video Bucket
Allow your portal to connect to your videos.

Step 1 - Apply IAM Permissions

Goal: Grant necessary permissions to the processing system for video streaming.

Preferred Approach: Create a new dedicated IAM role for edge video streaming.

1.1 - Create the IAM role

Create an IAM role for the processing system.

1.2 - Set up the trust policy for AWS-GCP federation

Required for our system to assume the role:

• Use the GSA sub ID we provide (it's the unique identifier for our service account).
• Apply this trust policy to the role.

Example of Trust Policy (Step 1.2):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "accounts.google.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:sub": "GSA_SUB_ID"
        }
      }
    }
  ]
}

1.3 - Attach the S3 bucket access policy

Attach a policy to allow access to the S3 video bucket (e.g., s3:GetObject, s3:ListBucket).

Example of Policy (Step 1.3):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::YOUR_VIDEO_BUCKET_NAME",
        "arn:aws:s3:::YOUR_VIDEO_BUCKET_NAME/*"
      ]
    }
  ]
}

1.4 - Set up AWS-GCP federation for cross-cloud compatibility

Provide Vionlabs with your IAM role ARN and region.

Note: For security, avoid reusing roles from other systems (e.g., processing or backend roles generated by Terraform). A dedicated role minimizes risk.

Step 2 - Configure CORS for Video Bucket

2.1 - Check existing CORS configuration

export YOUR_BUCKET_NAME=YOUR_VIDEO_BUCKET_NAME
aws s3api get-bucket-cors --bucket $YOUR_BUCKET_NAME

Expected output if no CORS is set: NoSuchCORSConfiguration.

2.2 - Apply CORS configuration

Create a file named cors_aws.json with the following content:

{
  "CORSRules": [
    {
      "AllowedOrigins": [
        "https://app.vionlabs.com",
        "https://app.staging.vionlabs.com",
        "https://dev.app.vionlabs.com",
        "https://portal.vionlabs.com"
      ],
      "AllowedMethods": ["GET", "HEAD"],
      "AllowedHeaders": ["*"],
      "ExposeHeaders": [
        "Content-Type",
        "Content-Length",
        "Content-Disposition",
        "Content-Range",
        "ETag",
        "Last-Modified",
        "Accept-Ranges"
      ],
      "MaxAgeSeconds": 3600
    }
  ]
}

Run the following command to apply:

aws s3api put-bucket-cors --bucket $YOUR_BUCKET_NAME --cors-configuration file://cors_aws.json

2.3 - Delete CORS and verify (optional)

Delete CORS only if needed:

aws s3api delete-bucket-cors --bucket $YOUR_BUCKET_NAME

For verification, re-run the following command to confirm the configuration:

aws s3api get-bucket-cors --bucket $SRC_BUCKET

Restricting Storage Access via IP Allowlisting (Recommended)

The Video Streaming Proxy requires access to the source video files via Signed URLs. We recommend restricting access to the storage buckets containing your video assets by using IP allowlisting and allowing only the following Vionlabs IP addresses:

XXX.XXX.XXX.XXX [Vionlabs to provide the actual IP address(es)]

This is an additional, optional layer of security on top of the IAM policy configured in Step 1 - it is not required, but recommended if your security policies call for it.

About Thumbnail & Clip Generation

Vionlabs is moving thumbnail and clip generation to a new cloud-based extraction service. This does not require any changes to your setup: the service retrieves source video through Vionlabs' video proxy, using the same access you've already configured in Step 1 - there is no additional bucket, IAM permission, or allowlisting needed on your end. Generated thumbnails and clips are stored in Vionlabs' own infrastructure and delivered to you via short-lived signed links - there's nothing to configure on either the input or output side.

Best Practices and Troubleshooting

Best Practices:

• Use least privilege for IAM roles. Keep permissions as limited as possible for security.
• Test your portal's access using your browser's developer tools. Test CORS settings using browser developer tools to confirm https://portal.vionlabs.com access.

Troubleshooting:

• CORS Errors: Ensure AllowedOrigins matches the portal URL exactly.
• Access Denied: Verify IAM role permissions.
• AWS-GCP Federation Issues: Confirm trust relationships and token configurations.

Next Steps

After configuring IAM permissions and CORS for Edge Video Streaming, you're almost ready to go live. To ensure everything works smoothly, take these next steps:

• Test video streaming from https://app.vionlabs.com/.
• Document any custom configurations for future reference.

Reach out to our team if you have any questions!