title: How do I serve protected videos from cloudfront
body: <p>I'm trying to serve private video content over RTMP, accessible only through a signed url</p>
  
  <p>Here are my CloudFront distribution settings: </p>
  
  <pre><code>Origin Domain Name : ct.recorder.s3.amazonaws.com   
  
  Restrict Bucket Access : Yes
  
  Origin Access Identity : Use an Existing Identity
  
  Your Identities : CT rtmp videos
  
  Grant Read Permissions on Bucket : No, I Will Update Permissions
  
  Restrict Viewer Access (Use Signed URLs) : Yes
  
  Trusted Signers : Self
  
  Distribution State : Enabled
  </code></pre>
  
  <p>When I try a signed cloudfront url, it'll fail to play.</p>
  
  <p>Am I missing something?</p>
  
  <p>I'm using the SDK to programmatically upload the video files, so I have control over the permissions I can set. Do I have to make a CannedACL or something?</p>
  
  <p>On the bucket level, I made a policy file:</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "PolicyForCloudFrontPrivateContent",
      "Statement": [
          {
              "Sid": "1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EF5LIV7LW3XE4"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::ct.recorder/*"
          }
      ]
  }
  </code></pre>
  
  <p>However it still doesn't work. I still can't access my videos</p>
  
  <p>I tried <code>rtmpdump</code> and that failed with a <code>NetStream.Failed</code></p>
  
  <h2>EDIT:</h2>
  
  <p>I got the free edition of Cloudberry for S3, and I went into the bucket and the objects in the bucket and set permissions so that the <code>Origin access identity</code> can <code>read</code>. </p>
  
  <p>The result is that <code>CloudFront Origin Access Identity EF5LIV7LW3XE4</code> has <code>Open/download</code> permissions on the object of the bucket, and it has <code>list</code> permissions for the bucket itself.</p>
  
  <p>But that didn't help. rtmpdump and the player still return errors.</p>
  
  <h2>EDIT:</h2>
  
  <p>I've tried editing the policy, but when I change it to what Michael suggests, save it, and view it again, my policy does not have my edits in it.</p>
  
  <h2>EDIT:</h2>
  
  <p>It's not that I can't edit the policy, it's that AWS auto-corrects the "CanonicalUser" to "AWS", and sets the values appropriately.</p>
  
  <p>So now I'm confused. The documentation says I need "CanonicalUser", but AWS won't let me do it.</p>
  
  <h2>EDIT:</h2>
  
  <p>After getting <a href="https://forums.aws.amazon.com/thread.jspa?threadID=141606&amp;tstart=0" rel="nofollow">official confirmation from the forums</a> that it does indeed auto-correct, I'll assume that my S3 bucket policy is correct, and that the problem is elsewhere. Perhaps with the library I'm using to sign my keys.</p>
  
  <h2>EDIT:</h2>
  
  <p>I tried using Cloudberry Explorer to create a signed cloudfront url, using my private key and <code>access ID</code>, but that url wouldn't work for either my player or <code>rtmpdump</code>.</p>
  
  <h2>EDIT:</h2>
  
  <p>I got confirmation that the node package that I was using to create signed urls wasn't compatible with rtmp urls. Is there a node package that is?</p>