Edge Video Streaming Setup Guide for GCP

Learn how to set up secure and efficient video streaming from your GCP environment to the Vionlabs platform.

The Vionlabs Edge Video Streaming Setup Guide provides step-by-step instructions for configuring secure and efficient video delivery from your GCP environment to the Vionlabs platform. It outlines how to apply Google Service Account permissions and configure CORS for your Cloud Storage video bucket - ensuring controlled access and optimized streaming performance.

This guide is intended for system administrators or technical engineers responsible for enabling video streaming within customer-managed GCP environments. Following the two outlined steps will help you establish a compliant, secure integration between your GCP video bucket and the Vionlabs portal.

For best results, apply least privilege when configuring your service account, test access directly from your portal environment using browser developer tools, and refer to the Best Practices and Troubleshooting section below if you encounter CORS errors, access denied responses, or GCP federation issues.

Introduction

This guide provides step-by-step instructions for end-customers to set up Edge Video Streaming on GCP infrastructure. It covers the two high-level steps required: applying Service Account policies and configuring CORS for the video bucket. This setup ensures secure and efficient video streaming from your GCP environment to the portal.

Prerequisites:

• Access to the Google Cloud project with appropriate permissions.
• An existing Google Storage bucket for videos (referred to as YOUR_VIDEO_BUCKET_NAME throughout this guide, without the gs:// prefix).
• Google Cloud SDK (gcloud) installed and configured with credentials for your target environment.

The guide is structured into 2 main steps. Follow them in order.

Overview of Setup Steps

01 - Google Service Account Permissions
Give your system the right access to manage videos.

02 - Set Up CORS for Video Bucket
Allow your portal to connect to your videos.

Step 1 - Google Cloud Service Account Permissions

Goal: Grant necessary permissions to the processing system for video streaming.

Preferred Approach: Create a new dedicated service account for edge video streaming.

1.1 - Create the service account

Create a service account for the processing system.

1.2 - Set up the trust policy for GCP-GCP federation

• Use the GSA email we provide (it's the unique identifier for our service account).
• Grant roles/iam.serviceAccountTokenCreator role to the provided service account.

Example of Trust Policy (Step 1.2):

gcloud iam service-accounts add-iam-policy-binding \
  sign-url@YOUR-PROJECT.iam.gserviceaccount.com \
  --member="serviceAccount:VIONLABS-GSA-EMAIL" \
  --role="roles/iam.serviceAccountTokenCreator" \
  --project=YOUR-PROJECT-NAME

1.3 - Grant bucket access to the service account

Grant the service account access to the Google Storage video bucket (Storage Object Viewer).

Example with gcloud utilities (Step 1.3):

# Grant Storage Object Viewer to specific bucket
gcloud storage buckets add-iam-policy-binding gs://YOUR-BUCKET-NAME \
  --member="serviceAccount:your-service-account@project-id.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

Note: For security, avoid reusing roles from other systems (e.g., processing or backend roles generated by Terraform). A dedicated role minimizes risk.

Step 2 - Configure CORS for Video Bucket

2.1 - Check existing CORS configuration

export YOUR_BUCKET_NAME=YOUR_VIDEO_BUCKET_NAME
gsutil cors get gs://$YOUR_BUCKET_NAME

Expected output if no CORS is set: has no CORS configuration.

2.2 - Apply CORS configuration

Create a file named cors_gcp.json with the following content:

[
  {
    "origin": [
      "https://app.vionlabs.com",
      "https://dev.app.vionlabs.com",
      "https://app.staging.vionlabs.com",
      "https://portal.vionlabs.com"
    ],
    "method": ["GET", "HEAD", "OPTIONS"],
    "responseHeader": [
      "Content-Type",
      "Content-Length",
      "Content-Disposition",
      "Content-Range",
      "ETag",
      "Last-Modified",
      "Accept-Ranges"
    ],
    "maxAgeSeconds": 3600
  }
]

Run the following command to apply:

gsutil cors set ./cors_gcp.json gs://$YOUR_BUCKET_NAME

2.3 - Delete CORS and verify (optional)

Delete CORS only if needed:

echo '[]' | gsutil cors set /dev/stdin gs://$YOUR_BUCKET_NAME

For verification, re-run the following command to confirm the configuration:

gsutil cors get gs://$YOUR_BUCKET_NAME

Restricting Storage Access via IP Allowlisting (Recommended)

The Video Streaming Proxy requires access to the source video files via Signed URLs. We recommend restricting access to the storage buckets containing your video assets by using IP allowlisting and allowing only the following Vionlabs IP addresses:

XXX.XXX.XXX.XXX [Vionlabs to provide the actual IP address(es)]

This is an additional, optional layer of security on top of the service account permissions configured in Step 1 - it is not required, but recommended if your security policies call for it.

About Thumbnail & Clip Generation

Vionlabs is moving thumbnail and clip generation to a new cloud-based extraction service. This does not require any changes to your setup: the service retrieves source video through Vionlabs' video proxy, using the same access you've already configured in Step 1 - there is no additional bucket, IAM permission, or allowlisting needed on your end. Generated thumbnails and clips are stored in Vionlabs' own infrastructure and delivered to you via short-lived signed links - there's nothing to configure on either the input or output side.

Best Practices and Troubleshooting

Best Practices:

• Use least privilege for the service account. Keep permissions as limited as possible for security.
• Test your portal's access using your browser's developer tools. Test CORS settings using browser developer tools to confirm https://portal.vionlabs.com access.

Troubleshooting:

• CORS Errors: Ensure origin matches the portal URL exactly.
• Access Denied: Verify service account permissions.
• GCP Federation Issues: Confirm trust relationships and token configurations.

Next Steps

After configuring Google Service Account permissions and CORS for Edge Video Streaming, you're almost ready to go live. To ensure everything works smoothly, take these next steps:

• Test video streaming from https://app.vionlabs.com/.
• Document any custom configurations for future reference.

Reach out to our team if you have any questions!