Comments on: Amazon CloudFront CFC

By: maria christensen

maria christensen — Mon, 27 Sep 2010 22:59:15 +0000

Thanks Ted, you saved me from getting crazy. I have been digging into this problem for two days.
/Maria

By: Ted Johnson

Ted Johnson — Mon, 26 Jul 2010 22:41:12 +0000

In case others run across the same problem, I have figured out what the deal is with making this work for RTMP (streaming) URLs. What you need to do is feed only the last part of the url, everything after "cloudfront.net/cfx/st/" into the function. This is not the case with HTTP (works to feed the function the entire URL).

So if your URL is:

rtmp://s17f59fd6dzkkt.cloudfront.net/cfx/st/folder/filename.mp4

You would call the function like this to make a signed URL:

cf.signUrlWithTimeout("folder/filename.mp4″,9000)

By: Ted Johnson

Ted Johnson — Mon, 26 Jul 2010 21:41:25 +0000

Thanks. Has anyone tested this with streaming (RTMP) distributions? Working well with HTTP, but what I really want to use it for is to stream video via Amazon Cloudfront and not having luck getting the URLs to work. Is there anything special to do to get this to work for RTMP URLs?

By: barneyb

barneyb — Mon, 26 Jul 2010 19:45:59 +0000

Again, check out the docs. Amazon has create the concept of "bucket ACLs", which allow you to specify the ACL at the bucket level, rather than the object level. If your entire bucket should be access controlled in the same manner, this is exactly what you want.

By: Ted

Ted — Mon, 26 Jul 2010 19:43:42 +0000

For those people wondering how to make the special "Origin Access ID" user, the way I figured out how to do it is using the cloudberry tool. There are very clear instructions here:
http://blog.cloudberrylab.com/2009/11/managing-cloudfront-private-content.html

My question is, do I have to go mark every single file as having "read" permissions for this user, or is there some way to set it up to automatically grant these permissions for all future files uploaded to the S3? Right now, all I see how to do is to "Edit ACL" on one of the S3 tools and turn on "read" for this special user. That does make the file readable. But for someone with hundreds of virtual folders and files, it could be a real headache.

By: barneyb

barneyb — Mon, 26 Jul 2010 18:00:18 +0000

Yes, exactly. All the info you need is in the AWS docs, so that's the place to go look: http://aws.amazon.com/documentation/

By: Ted

Ted — Mon, 26 Jul 2010 17:58:37 +0000

Okay, so there is a "cloudfront" user I need to give access on the ACL? I don't see that user anywhere on the ACL using the Firefox S3 Manager., so I'm guessing this is a user I need to create? (I assume "cloudfront" isn't the right name for it). If you can point me in the right direction, it would be very much appreciated.

By: Ted

Ted — Mon, 26 Jul 2010 17:56:14 +0000

Here is an example of an unprotected file I can access using cloudfront without a problem:

http://dltjymh90ljni.cloudfront.net/2010/January/Classes/Kristi/kristi_010510_shortfull_hd.mp4

I would think that suggests the bucket is set up correctly for cloudfront. I have also streamed the same file using RTMP (set up a different cloudfront URL for the same bucket for streaming).

By: barneyb

barneyb — Mon, 26 Jul 2010 17:56:00 +0000

You just found your answer. CloudFront is doing just fine, it's S3 that is giving you "access denied." In order for CloudFront to front a protected S3 bucket, you have to configure the bucket to allow CloudFront access. It's all spelled out on the AWS developer docs, but basically you just need to give the CloudFront principal read access to your bucket, otherwise the S3 security prevents CloudFront from accessing it.

By: Ted

Ted — Mon, 26 Jul 2010 17:53:34 +0000

If I change the ACL on the S3 for a file to "Everyone = Read" then I can get the file just fine via HTTP or RTMP using the cloudfront URLs. It's just when I try to protect the file that I run into problems. When you say a "configuration error somewhere" what does that mean? There aren't exactly a whole lot of moving parts here!