Setting up AWS S3

What you'll do

• Use an AWS account you already trust, or create a new one.
• Create one private S3 bucket for your VOD archive.
• Create an IAM user with a scoped policy. IAM is AWS's permission system, and the policy below limits what the key can touch.
• Paste the bucket name, region, and access keys into VOD Manager.

Plan on about 15 minutes. Most of that time is AWS account navigation, not VOD Manager setup.

Step 1 — AWS account check

Step 2 — Pick your region

Step 3 — Create the S3 bucket

1. Open the S3 section in the AWS console and choose Create bucket.
2. Use a globally unique name, such as vod-manager-your-username-archives. Bucket names are shared across AWS, so simple names are usually taken.
3. Set the region to the region you picked in Step 2.
4. Block all public access: leave ON. Your VOD archive should be private. VOD Manager does not need public files.
5. Leave bucket versioning Disabled unless you already know why you need it. The default SSE-S3 encryption option is fine.
6. Create the bucket and copy the exact bucket name. You will need it for the IAM policy and the VOD Manager connection form.

Step 4 — Create a least-privilege IAM user

1. Open the IAM section in the AWS console, find Users, and choose Create user.
2. Name the user vod-manager. Do not enable AWS Management Console access. VOD Manager only needs programmatic access, which means an access key used by an app.
3. For permissions, choose Attach policies directly, then create a policy with the JSON in the next section. Replace YOUR-BUCKET-NAME with your real bucket name in both places.
4. Save the policy as vod-manager-bucket-rw, attach it to the user, and finish creating the user.
5. Open the new user, go to Security credentials, and create an access key. Choose Application running outside AWS as the use case.
6. Save the Access Key ID and Secret Access Key immediately. AWS only shows the secret once. If you lose it, create a new key and delete the old one.

The minimal IAM policy

Paste this policy into AWS, then replace every YOUR-BUCKET-NAME placeholder with your bucket name. ListBucket and HeadBucket let VOD Manager test the connection. PutObject, GetObject, and DeleteObject let it archive files and remove old files when you ask it to auto-purge.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:ListBucket",
                "s3:HeadBucket"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME",
                "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            ]
        }
    ]
}

Step 5 — Connect VOD Manager

• Provider: choose AWS S3.
• Endpoint: leave blank. AWS uses its normal regional endpoint automatically.
• Region: enter the region you picked earlier, such as us-east-1.
• Bucket: enter the exact bucket name.
• Access Key ID and Secret Access Key: paste the values from the IAM user.
• Click Test connection. VOD Manager will try a tiny write, read, and cleanup check so you know the key can use the bucket.

Common issues

• Access denied on PutObject: the policy is missing s3:PutObject, or one of the bucket ARNs does not match your real bucket name.
• Bucket not found: the bucket may be in a different region than the one you entered in VOD Manager.
• InvalidAccessKeyId: the access key may have a typo, or you may have pasted the IAM user's username and password instead of the access keys.