在這個場次您會學到如何在AWS上運作串流服務，包括隨選視訊(VOD)和實時串流; 如何在雲端上設置Wowza媒體伺服器來執行隨選視訊(VOD)和實時串流的轉碼工作; 講師也會分享以AWS S3和CloudFront來執行隨選視訊(VOD)和實時串流服務的最佳實踐和現場示範。 講師: Harry Lin, Solutions Architect, Amazon Web Services

1. September 2016
Media Streaming on AWS
Harry Lin (林書平), Solutions Architect
Amazon Web Services

2. Agenda
• Media Streaming Overview
• Media Streaming on AWS
• Demo
– On-­‐Demand Streaming
– Live Streaming

3. Overview, Workflows, Solutions

4. ENCRYPT
TRANSCODE
MANAGELIVE
Browser
PUSH/
PULL
Set Top Box
Studio Affiliate
Mobile
REFLECT/
RECORD
ENCAPSULATE/
STREAM
ON
DEMAND
UPLOAD/
INGEST
STREAM
CDN
STORE/
DELIVER
ARCHIVE

5. Encode Process Store Deliver Analyze
Mezzanine Files
Contribution Feeds
Multi Protocol
Single Codec
Integration
Media Fragments
Manifests
Players
HWEnc, FMLE,
Aspera,
EC2
INB, OOB,
CDN,
Cloudfront
Examples
Source
Sink
Target
Security
Transport
Codec
Derivatives
Recordings
Cache
ETS,
Wowza
Live
S3, EFS,
EBS,
RAM, VOD
Omniture,
EMR, RedShift,
ELK
Usage Analytics
Security Feedback
End to End Media Delivery

6. § Storage - File (On-demand), Live (streaming, Linear)
§ Encryption - Pipe / File (AES) vs. Content (DRM) Protection
§ Metadata - Set (Bitrate) vs. Stream (TS) level Manifests
Encoding Playout
Codec (H.264), Multiplex (MP4), Transport (HLS), Bitrate / Profile (ABR)

8. § Ingest S3, Aspera, Signiant, TsunamiUDP
§ Streaming Cloudfront, Wowza, Adobe AMS, NGINX+, USP
§ Toolkits FFMPEG, GPAC / MP4Box
§ DRM BuyDRM, EzDRM
§ Encoding ETS, Harmonic, Zencoder, Telestream, Elemental Cloud
§ Playback JWPlayer, BitMovin, Other OSS (OSMF / VideoJS etc.)
§ Reflectors EvoStream cRTMPD, Haivison, Teradek, StreamBox
§ Security - AlertLogic, OSSEC / Tripwire, TrendMicro, AlienVault
§ Analytics - EMR, Redshift, Kinesis, ELK, Splunk, Graylog2, Omniture
§ Broadcast - Haivision, Teradek, StreamBox
MARKETPLACE / AWS OSSPAAS / SAAS

9. § Wowza - Web (Internal+XML), ‘CLI‘, Java SDK, Plugins w/ SI ecosystem,
pluggable DRM (Widevine, etc.), Transcoding integration
§ AMS - Web (Apache), ‘CLI’, Windows, C++ SDK, SSAS Scripting (with
limitations), Adobe Access DRM, HDS, IOS/Android DRM SDK
§ NGINX - OSS+Commercial, rtmp-module, FFMPEG, Pattern Approach
§ USP - Web (pluggable) & CLI, H/W Encoders, Modular, Frame accurate
§ Others - SRS, IIS Media Services, MistServer, Fluendo
MPEGTS RTMP HLS DASH RTC DATA
Ingest Playout

10. § Infrastructure - Depends entirely on user model – Live, VOD, UGC
Eliminate infrastructure for VOD via S3 + CloudFront
Minimize Realtime infrastructure
Use transcoder/media server for transcode pipelines
HTTP-based streaming is getting popular
Ingest Proxy Origin Edge ELB CF Client
RTMP + MPEGTS | HLS + DASH + ( HDS + SS )
Infrastructure

11. Solutions, Architecture

12. AWS Services Stack in Media Workflow
AWS Direct
Connect
Elastic
Load
Balancing
AWS Import/
Export
Amazon
S3
AWS Storage
Gateway
Amazon
EBS
Amazon
CloudFront
Amazon
CloudSearch Amazon
SQS
Amazon
Elastic
Transcoder
Amazon
EC2
Amazon
EMRAmazon
VPC
Ingest/Create Store
Amazon
RDS Amazon
ElastiCache
Amazon
Route
53
DeliverProcess
Amazon
EC2

13. Amazon CloudFront
• Global content delivery via 59 edge locations
• On-demand and live streaming
• Supports both HTTP and RTMP streaming
• Native support for Smooth Streaming
• Set custom TTLs to cache all types of content
• TCP optimizations
• Customize content at the edge
• Detect device type, geo-location, language, etc.

14. Amazon S3
(Media storage)
Amazon CloudFront
Amazon CloudFront Security
End user
HTTP
________
HTTPS ONLY
• Custom SSL certificate
• Integrated with Amazon Certificate Manager (ACM)
• Amazon CloudFront’s private content feature
Only deliver content to securely signed requests
• HTTPS ONLY requests/delivery, origin fetches
• HTTP to HTTPS redirect at the edge
• Signed URL or signed cookie verification
Policy based on a timed URL/cookie or a CIDR block of the requestor
• Amazon CloudFront Origin Access Identity (OAI)
Delivery Amazon EC2
instances
Security group
Signed request
Amazon S3
(Logs storage)
"Effect":"Allow",
"Principal":{
"CanonicalUser":"79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8"
},
"Action":"s3:GetObject",
"Resource":"arn:aws:s3:::example-­‐bucket/*”

15. Amazon Elastic Transcoder
• Scalable, cost effective (per-minute pricing)
• Integrated with AWS services and tools (Amazon
SNS, Amazon S3, AWS IAM, AWS CloudTrail, and
AWS SDK)
• Codecs, processing, and licensing baked in
• Outputs:
• Popular web formats such as MP4 with H.264/AAC and
WebM with VP8/Vorbis
• Adaptive bitrate formats such as HLS and Smooth Streaming
• Audio-only processing for inputs and outputs
• Features include captions, visual watermarks,
clipping, and more

16. Amazon Elastic Transcoder Security
• Encryption at rest
Server managed keys
Client provided keys
• Integration with AWS Key Management Service
Amazon Elastic Transcoder only accepts AWS KMS protected keys
Key is never written or stored in cleartext
• Encryption for HLS streams
Built on top of “client provided keys” API
Amazon Elastic Transcoder generates HLS playlists embedding URI for decryption key
• Digital Rights Management
PlayReady DRM packaging
• CloudTrail Integration

17. Media Software on
AWS Marketplace
• Launch software on AWS with
1-Click
• Pay-by-the-hour, monthly, or
annual
• Single invoice for AWS usage
& ISV software
• Free Trials

18. Architecture for VOD and Live Streaming
Amazon
CloudFront
distribution
Amazon Elastic
Transcoder
Amazon S3
bucket
Amazon S3
bucket
Media file
Live stream
Media servers on
Amazon EC2
Amazon
CloudFront
distribution
Origin Access Identity
HTTPS
HTTPS
Media consumer

19. AWS Import/ Export
S3 multi-part API
S3 as backend storage for Content Files
accessible to other processing tasks
Amazon Elastic
Transcoder
S3
Notification
Trigger a Lambda
Function to Start a
transcoding job
Ingest
S3
Notification
Lambda function
to generate a
signed URL to
share the file
App Servers
to Update
Metadata
Serverless Architecture for VOD Media
Processing

20. § Expand compute
capacity of
Manager node(s)
§ 100ms billing &
short run-time
§ Ideal for chunk
storage, pre- &
post-processing
https://github.com/binoculars/aws-lambda-ffmpeg
Lambda Pre- and Post- Processing

22. On-demand Streaming Demo Components
• AWS services used:
– Amazon S3 for storage
– Amazon Elastic Transcoder for transformation and encryption
– Amazon CloudFront for global delivery
• Safari as a HLS player
• Benefit from the high availability, scalability, and
low cost offered by AWS services.

23. On-Demand Transcoding and Delivery
Amazon S3
bucket
Amazon
CloudFront
Amazon
Elastic
Transcoder
Media owner
Amazon S3
bucket
Amazon SNS

24. Automatic VOD Media Processing Via Lambda
Amazon S3
Elastic Transcoder
Amazon S3Amazon Lambda
Transcoding
Media
Files
Transcoding
Request
S3
Notification
Delivery
Lambda Invocation
API Call
Transcoder
Execution CloudFront

25. Amazon S3 bucket
Amazon
CloudFront
distribution
Availability Zone a
Elastic Load
Balancing
Amazon EC2 instance
web app
server
Availability Zone b
Amazon Elastic
Transcoder
Media owner
AWS Key Management Service
Amazon S3 bucket
Amazon EC2 instance
Amazon DynamoDB
Key Name Base64 Encoded Key
Big Buck Bunny EuoK6SNJcoZ7V8gRqSszdA6yp8MZTbrBY…
Elephants Dream T4iu3N8ZAyzk1JMesuyEQ46tCW5BA43sad…
On-Demand Transcoding and Encrypted
Delivery

26. VOD Best Practices
• Only allow CDN to access source content
• Define high TTL settings for .ts and .m3u8 files
• Geo Block access to stream if necessary
• Define 4xx / 5xx Error Caching Minimum TTL to 0

28. Live Streaming Demo Components
• Uses Amazon EC2 running Wowza
• Transcodes using Wowzag with RTMP module
• RTMP/HLS/MPEG-DASH live streaming

29. Live Streaming with Wowza Media Server
RTMP stream
Amazon
CloudFront
Amazon Route 53

30. Scalable Live Streaming with Wowza Media
Server
RTMP stream
Amazon
CloudFront
ELB
Availability Zone a
Availability Zone b
Route53
Policy
Routing

31. Live Streaming with Self-Developed Media Services

32. Best Practices
• Limit access to port 1935 to only trusted
sources
• Define TTL settings for .ts files and .m3u8
• Geo-block access to stream if necessary
• Randomize the .ts file name for live streams

33. Allow access to port 1935 from
trusted sources
Type Protocol Port Range Source
HTTP TCP 80 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0
Custom TCP rule TCP 1935 54.255.255.0/32

34. Define TTL settings for .ts files and .m3u8

35. Geo-restrict access to stream if necessary

36. Wrap-Up
• Build your VOD and live streaming quickly on
AWS
• Secure your streaming service via AWS security
services
• Focus on solution for streaming service
– Ingest
– Storage
– Playback
– Delivery
– Analysis

37. Thank You!