Building Security Conscious Video Streaming Infrastructure on AWS, Lesson 2: Protect Your Buckets

Welcome to the second installment of our series, highlighting lessons learned from actual AWS customers. This series also offers insights into how you can bolster the security of your AWS streaming infrastructure. For those interested in our first article, you can find it here: Lesson 1: Don't Hardcode Security Credentials

First off, it's important to understand that Amazon S3 is secure by default. When customers employ the default configuration, access is limited solely to the account owner and root administrator. Over a million customers use Amazon S3 with confidence in its security. However, when setting up Video on Demand (VOD) resources that stream from an S3 bucket, a mechanism to safely access that video content becomes imperative. That leads us to the crux of today's article: Use an Amazon CloudFront Distribution to serve your content and maintain the anonymity of your S3 bucket's URL. With that, let's delve into this week's topic: Lesson 2: Protect Your Buckets.

Amazon Simple Storage Service (S3), our premier storage solution, seamlessly scales to meet your Video on Demand (VOD) requirements. By default, S3 does not make buckets publicly accessible on the internet. A deliberate series of steps is needed to grant such access. My recommendation? Restrict access to particular users or services. While S3 can adeptly serve content, avoid doing it directly from the bucket. Instead, place an Amazon CloudFront Distribution over it and employ Origin Access Control. This ensures that only a designated CloudFront Distribution can access the S3 bucket. By doing so, CloudFront obscures your S3 URL, all the while capitalizing on AWS security infrastructure such as AWS Shield for automatic protection against common internet threats.

Amazon CloudFront Developer Guide

To reiterate, while we can delve deep into S3 security intricacies and explore features that protect data both at rest and in transit, developers can ensure enhanced safety simply by using a CloudFront Distribution to serve content from an S3 bucket instead of exposing the bucket to the entire internet. I urge readers to utilize this article as a springboard for future deep dives into securing buckets, encrypting S3 objects, implementing signed URLs, whitelisting access from specific services or URLs, and more. AWS offers a depth and breadth of services to streamline and secure your streaming operations. I encourage you to delve into all the options. I also invite you to share your insights and lessons here, contributing to our community's collective wisdom.

In conclusion, a word of advice: As you transition from a small to a larger business, recognize that with greater success comes greater risk. Ensure that as you expand, you periodically conduct "sanity checks." Ask yourself: Am I operating as securely and efficiently as possible? Stay vigilant and curious, and success will be yours. Best of luck! (Come back soon for Lesson 3: Prepare for Traffic Surges)