AWS ivs medium security documentation change
Summary
Expanded playback restriction policy documentation with detailed console/CLI instructions, strict origin enforcement notes, and implementation guidance for iOS Safari.
Security assessment
The changes add detailed instructions for configuring playback restrictions (allowed countries/origins) and strict origin enforcement, which are security controls to prevent unauthorized content access. The strict origin enforcement note explicitly describes security measures for client validation.
Diff
diff --git a/ivs/latest/LowLatencyUserGuide/undesired-content.md index 86c671c1e..b2cc83584 100644 --- a/ivs/latest/LowLatencyUserGuide/undesired-content.md +++ b/ivs/latest/LowLatencyUserGuide/undesired-content.md @@ -127 +127 @@ If you do not want to use private channels, you can still benefit from some of t -To learn more about playback restriction policies, see: +#### Console Instructions (Playback Restriction Policy) @@ -129 +129 @@ To learn more about playback restriction policies, see: - * [Getting Started with IVS Low-Latency Streaming](https://docs.aws.amazon.com/ivs/latest/LowLatencyUserGuide/getting-started.html) – See the information on preventing undesired content and Viewers. + 1. Create a playback restriction policy @@ -131 +131,42 @@ To learn more about playback restriction policies, see: - * [IVS Low-Latency Streaming API Reference](https://docs.aws.amazon.com/ivs/latest/LowLatencyAPIReference/Welcome.html) – See playback restriction policy operations and the PlaybackRestrictionPolicy object. + 1. [Open the Amazon IVS console](https://console.aws.amazon.com/ivs). On the left navigation pane, select **Playback security > Playback restriction policies**. + + 2. Select **Create policy**. + + 3. Optionally, name the policy. + + 4. Optionally, toggle **Strict origin enforcement** (see note below). + + 5. Specify **Allowed countries** and **Allowed origins**. + + 6. Select **Create policy**. + + 2. Attach this policy to a new or existing channel + + 1. Create a new channel or edit an existing channel. + + 2. In the **Restrict playback section** (of the **Create channel** or **Update channel** window), select **Enable playback restriction**. + + 3. From the **Playback restriction policy** drop-down list, select the policy you created in Step 1. + + 4. Select **Create channel** (for a new channel) or **Save** (to update an existing channel). + + + + +**Note on strict origin enforcement:** This is an optional setting that can be used to strengthen the origin restriction specified with allowed origins. By default, the origin restriction applies only to the multivariant playlist. If strict origin enforcement is enabled, the server will enforce a requirement that the requesting origin matches the policy for all playback requests (including multivariant playlist, variant playlist, and segments). This means that all clients (including non-browser clients) will have to provide a valid origin-request header with each request. Use the `setOrigin` method to set the header in the IVS iOS and Android player SDKs. It is set automatically in web browsers except iOS Safari. For iOS Safari, you need to add `crossorigin="anonymous"` to the video element, to ensure that the origin request header is sent. Example: `<video crossorigin="anonymous"></video>`. + +**Note on mapping between IP addresses and countries:** IVS determines the location of your users by using a third-party database. The accuracy of the mapping between IP addresses and countries varies by region. Based on recent tests, the overall accuracy is 99.8%. If IVS can't determine a user's location, IVS serves the content that the user requested. + +#### CLI Instructions (Playback Restriction Policy) + + 1. Create a playback restriction policy. Here is an example. _For the`allowed-countries` and `allowed-origins` fields, replace the example values below with your actual values, or delete one or both fields, depending on your use case._ + + aws ivs create-playback-restriction-policy --name test-playback-restriction-policy --enable-strict-origin-enforcement --allowed-countries "US","JP" --allowed-origins "https://example1.com","https://*.example2.com" + +This returns a new playback restriction policy. For its fields, see [PlaybackRestrictionPolicy](https://docs.aws.amazon.com/ivs/latest/LowLatencyAPIReference/API_PlaybackRestrictionPolicy.html) in the _IVS Low-Latency Streaming API Reference_. + + 2. Attach the new policy to a channel. For an existing channel, run `update-channel` and pass in the ARN of the playback restriction policy created in the previous step: + + aws ivs update-channel --arn "arn:aws:ivs:us-west-2:123456789012:channel/abcdABCDefgh" --playback-restriction-policy-arn "arn:aws:ivs:us-west-2:123456789012:playback-restriction-policy/abcdABCDefgh" + +For a new channel, include the `--playback-restriction-policy-arn` statement during [channel creation.](./create-channel-cli.html)