在CloudFront中使用私有ACL？

Question

I am developing a web app where video files are stored on Amazon S3 and using CloudFront is an optional feature which can be turned on and off at any time.

I have a bunch of video files set with private ACLs, and I use signed URLs to access them. This works great.

However, I want to create a CloudFront RTMP distribution on that bucket, but it would be difficult to programmatically update every single (Could be well over 300) object's ACL each time (And would take a long time for all the requests to happen since you can't do it by batch, right?).

Is there a way to either:

• Set ACLs in bulk, in one call?
• Set a bucket access policy so that CloudFront can read any private files in the bucket?

I have attempted creating an Origin Access Identity, and then adding this to the bucket's Access Control Policy but this doesn't appear to work.

And finally do I still need to sign the URLs when I send them to the video player?

This does all need to be done programatically in PHP so using CloudBerry and such won't be helpful to me unfortunately.

Answer 1

This is a useful guide to get started, it tells how to set up the private distribution: http://www.bucketexplorer.com/documentation/cloudfront--how-to-create-private-streaming-distribution.html

You can set the ACLs via the AWS API looping through your videos in a series (I don't think this can be done in bulk, even BucketExplorer does this in a queue). You only need to set the ACLs on each file once. You need to make sure you grant access to the Canonical User you have in your Origin Access Identity for the distribution. This way the distribution can access the protected file from the S3 origin. You then need to set up a key-pair and a trusted signer.

You do need to sign the URLs every time someone accesses the video. There are a number of scripts available. This is a useful guide for Ruby, but you could quite easily rewrite the code in PHP: http://r2d6.com/posts/1301220789-setting-up-private-streaming-with-cloudfront-and-ruby-on-rails