Joe Miller bio photo

Joe Miller

Ops/Engineering. Continuous DevOping at Webscale

Twitter Github

Back in late 2010 I had a need to create a private Cloudfront streaming distribution but there was no simple way to do this. Amazon’s web-based AWS Management Console did not support this and I could not find any simple CLI tools for doing this.

Luckily, RightScale’s right_aws ruby gem (>= 2.0.0) provides support for the Cloudfront private streaming API.

These tools should make it simple for any linux admin or developer to get started with creating a private streaming distribution on Amazon.

The code and detailed documentation is available on github:

To read more, and see example usage, click past the break!

Example Usage

In this example we will setup a new Cloudfront Private Streaming distribution with the following attributes:

  • S3 origin bucket: my-video-bucket
  • CF base URL (CNAME): rtmp://

1. Setup AWS keys

$ export AWS_ACCESS_KEY_ID='xxxxx'
$ export AAWS_SECRET_ACCESS_KEY='xxxxxx'

2. Create a new Cloudfront Streaming Distribution

$ ./cf-streaming-distribution.rb create my-video-bucket \
    --cname \
    -m "private streaming distribution (rtmp) with origin bucket: my-video-bucket"

 aws_id: E1UGDLB9XZBD79

3. Configure CNAME in your DNS server

This part will depend on DNS server or DNS provider. You’ll need to create a new CNAME for –>

4. Create a new Origin-Access-ID (OAI)

$ ./cf-origin-access-id.rb create "OAI for use on the distribution"

 Location :
 S3 Canonical ID: 3b5285f7f1b51ff2e63e8ff8127b7ffb76edee24580cb7fff6ef812aa87b749aaa3ed1aab389aaaab4453499a7ba57e7

5. Assign the OAI to the Cloudfront distribution

$ ./cf-streaming-distribution.rb modify E1UGDLB9XZBD79 --oai E2CWXW7A1B3YIU

6. Grant the OAI access to the files in the S3 bucket

$ ./cf-origin-access-id.rb grant E2CWXW8B1U3YJU my-video-bucket
 Applying grant [E2CWXW8B1U3YJU:'FULL_CONTROL'] on: my-video-bucket/flvs/video01.flv
 Applying grant [E2CWXW8B1U3YJU:'FULL_CONTROL'] on: my-video-bucket/flvs/video02.flv

7. Create RSA Keypair on the Amazon AWS website

You cannot create keypairs with the cloudfront API, so you’ll need to do this step on the AWS website.

  • Goto then login:
  • Account > Security Credentials > Key Pairs
  • Click “Create New Key Pair” under the “Cloudfront Key Pairs” section
  • A keypair will be created and the private key will automatically begin downloading.

You must save this file! it will be in the form “pk-XXXXXX.pem”. If you lose this key, you can’t get it back because Amazon only stores the public key.

8. Register the account and keypairs on the cloudfront distribution

NOTE: the –trusted-signer arguments takes an amazon account ID as an argument.
The special ‘self’ can be used instead.

$ ./cf-streaming-distribution.rb modify E1UGDLB9XZBD79 --trusted-signer self

9. Verify settings on the new private Streaming Distribution

$ ./cf-streaming-distribution.rb get E1UGDLB9XZBD79
 Status : InProgress
 Enabled : true
 domain_name :
 origin :
 Comment : private streaming distribution (rtmp) with origin bucket: my-video-bucket
 Origin Access ID: origin-access-identity/cloudfront/E2CWXW7A1B3YIU
 Trusted Signers : self
 Active Signers:
     -> aws_account_number: self
          -> key_pair_id : APDBDOEHALFXGK5AQU5R

NOTE: The distribution will not be usable until Status changes from InProgress to Deployed. This can take up to 15minutes.

You can also use the command cf-streaming-distribution.rb wait AWS_ID to wait for a distribution to change from InProgress to Deployed. The command will exit as soon as the status changes to Deployed. This is useful for scripts where you need to control timing.