Kinesis Video Streams with IoT Credentials Provider problem

Question

When trying to start streaming to KVS using [Amazon Kinesis Video Streams CPP Producer GStreamer Plugin and JNI](https://github.com/awslabs/amazon-kinesis-video-streams-producer-sdk-cpp) and providing IoT certificates in order to obtain credentials from IoT Credentials Provider using the following command:

``gst-launch-1.0 -v rtspsrc location="rtsp://user:password@192.168.1.123/stream" short-header=TRUE ! rtph264depay ! h264parse ! kvssink aws-region=eu-west-2 stream-name="My-Stream-01" iot-certificate="iot-certificate,endpoint=xxxxxxxxx.credentials.iot.eu-west-2.amazonaws.com,cert-path=/greengrass/v2/thingCert.crt,key-path=/greengrass/v2/privKey.key,ca-path=/greengrass/v2/AmazonRootCA1.pem,role-aliases=MyStreamingRoleAlias" ``

The process fails with an error:

`` ERROR   blockingCurlCall(): Curl perform failed for url https://xxxxxxxxxxxx.credentials.iot.eu-west-2.amazonaws.com/role-aliases/MyStreamingRoleAlias/credentials with result Timeout was reached : Resolving timed out after 3000 milliseconds
ERROR - Unable to create Iot Credential provider. Error status: 0x15000025
ERROR: Pipeline doesn't want to pause.
ERROR: from element /GstPipeline:pipeline0/GstKvsSink:kvssink0: Could not initialize supporting library.
Additional debug info:
/home/pi/amazon-kinesis-video-streams-producer-sdk-cpp/src/gstreamer/gstkvssink.cpp(1402): gst_kvs_sink_change_state (): /GstPipeline:pipeline0/GstKvsSink:kvssink0:
Failed to init kvs producer. Error: Unable to create Iot Credential provider. Error status: 0x15000025
``

The machine I am trying to get this running on is a BannanaPi M5 with followng architecture and OS:

Linux bananapi 4.9.241-BPI-M5 #2 SMP PREEMPT Mon Jun 21 16:29:40 HKT 2021 aarch64 GNU/Linux
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:        10
Codename:       buster

When tested the on following RaspberryPi 3B+:

Linux raspberrypi 5.10.103-v7+ #1529 SMP Tue Mar 8 12:21:37 GMT 2022 armv7l GNU/Linux
Distributor ID: Raspbian
Description:    Raspbian GNU/Linux 10 (buster)
Release:        10
Codename:       buster

and on the same network, the command starts successfully and starts streaming to KVS with no problems.

With CURL request I have tested if IoT credentials provider will return AWS Credentials. It does and it works perfect hence I rule out network/endpoint/policies errors.

I have BananaPis in production environment and want to implement CCTV streaming to KVS using existing IoT certificates for authentication.

Is there any knowledge why it fails in this case and is there any way to overcome this problem?
Any help highly appreciated.

Accepted Answer

The error you're encountering seems to be related to a timeout when trying to resolve the IoT credentials provider endpoint. The specific error message "Resolving timed out after 3000 milliseconds" suggests that the DNS resolution for the IoT credentials provider endpoint is taking longer than the allowed 3 seconds.

Given that the same command works on a RaspberryPi 3B+ on the same network, it's unlikely to be a network issue. Instead, it might be related to the specific environment or configuration on the BananaPi M5.

Here are some steps to troubleshoot and potentially resolve the issue:

**DNS Resolution:**
- Test the DNS resolution speed on the BananaPi M5 using **dig** or **nslookup** for the IoT credentials provider endpoint.
`dig xxxxxxxxxxxx.credentials.iot.eu-west-2.amazonaws.com`

- If the DNS resolution is slow, you might want to change the DNS servers used by the BananaPi M5. For instance, you can use Google's public DNS servers (8.8.8.8 and 8.8.4.4) or Cloudflare's (1.1.1.1).

**Increase Timeout:**
- If possible, increase the timeout for the IoT credentials provider in the KVS CPP Producer. This might not be directly configurable via the GStreamer command, but you might be able to modify it in the underlying SDK or source code.

**System Resources:**
- Check the system resources on the BananaPi M5. Ensure that it's not running out of memory or CPU. High resource usage can slow down operations, including network requests.

**Software Versions:**
- Ensure that the versions of the KVS CPP Producer, GStreamer, and other related software are the same on both the RaspberryPi and the BananaPi. Differences in versions might lead to different behaviors.

**Network Tools:**
- Use tools like **traceroute** to check the network path from the BananaPi M5 to the IoT credentials provider endpoint. This can help identify any network bottlenecks or issues.
`traceroute xxxxxxxxxxxx.credentials.iot.eu-west-2.amazonaws.com`

**Logs & Debugging:**
- Increase the logging level for the KVS CPP Producer and GStreamer to get more detailed logs. This might provide more insights into where the issue is occurring.

**Alternative Methods:**
- As a workaround, you can consider obtaining the IoT credentials on the BananaPi M5 using a script or another method and then passing them directly to the KVS CPP Producer, bypassing the need for the SDK to fetch them.

**Update & Upgrade:**
- Ensure that the BananaPi M5 is updated with the latest packages and firmware. Sometimes, issues can be resolved with updates.

**Environment Differences:**
- There might be subtle differences between the environments of the RaspberryPi and the BananaPi. Ensure that any environment variables, configurations, or system settings that might affect the operation of the KVS CPP Producer are consistent between the two devices.

If after trying the above steps the issue still persists, you might need to dive deeper into the specific configurations and environment of the BananaPi M5 to identify the root cause.

Kinesis Video Streams with IoT Credentials Provider problem

Relevant content