Slightly OT: Restricting Read only access to media on S3 for Roku

Archived
1

Hello all:

I use AWS S3 for my HLS files (plus the m3u8 manifest). As such, I make the media read access to everyone so my Roku channel can read the media.

Is there a way on AWS to force Read access only via Roku?

Context: my S3 bill last month was 13x higher than normal - but no additional traffic on my Roku channel and 95% of it was from one 24 hour period. I can only surmise that the URLs for the media were accessed somehow, as they were public. This bucket is only used for my HLS streams.

Thanks!

2

You could control access based on the User-Agent header, which usually has “Roku” in it. Here’s an access policy that should work: https://stackoverflow.com/questions/27437438/amazon-s3-bucket-policy-filter-by-user-agent

But it’s pretty easy to generate a custom User-Agent header so that would be no guarantee that it’s a Roku device accessing your files.

You’ve probably already done this, but it’s also important that to have a bucket access policy that blocks indexing. Not doing this would allow anyone to list the bucket contents: https://stackoverflow.com/questions/9558831/how-to-prevent-directory-browsing-of-s3-bucket

3

This is great information. I’ll do some digging. Thanks!

4

Are there any shared credentials that Roku has? The User-Header could be spoofed (as you mentioned).

I can certainly prevent indexing, I’ll verify that.

Edit: Verified. ACL Access to “Everyone” in the bucket has list objects, write objects, and read and write bucket permissions unchecked.

Digging into the logs, it looks like iTunes from systems on the same network (20.185.243.xx) trying to download MP4 files that sit on S3 for Roku and for various Podcast outlets that pull from that bucket. However, the file is failing on the download, so iTunes keeps trying. But it seems to be massively fast, almost as if the iTunes was sitting on a fiber connection (not a data center, as it’s from a macOS) the download times out after ~1/4 of a second, but having transferred several dozen MB or more in that time.

Anyway, any other suggestions are appreciated.

Thanks again!