AWS ivs medium security documentation change
Summary
Updated event descriptions and added detailed error code tables with troubleshooting guidance for Destination Failure, Session Failure, Recording Start/End Failure events
Security assessment
Added explicit documentation about AccessDeniedException errors related to S3 bucket policies and permissions verification. This addresses security-related misconfigurations that could lead to data exposure or recording failures. The guidance to verify bucket policies directly relates to security best practices.
Diff
diff --git a/ivs/latest/RealTimeUserGuide/eventbridge.md b/ivs/latest/RealTimeUserGuide/eventbridge.md index 2b136985f..0ebc538f0 100644 --- a//ivs/latest/RealTimeUserGuide/eventbridge.md +++ b//ivs/latest/RealTimeUserGuide/eventbridge.md @@ -28 +28 @@ Event Type | Event | Sent When ... -IVS Composition State Change | Destination Failure | An attempt to output to a Destination failed. For example, broadcasting to a channel failed because there was no stream key or another broadcast was happening. +IVS Composition State Change | Destination Failure | An attempt to output to a Destination failed (e.g., the S3 bucket was not found, access was denied to the S3 bucket, or the stream already exists for an RTMP destination). @@ -34 +34 @@ IVS Composition State Change | Session End | A Composition session completed. -IVS Composition State Change | Session Failure | A Composition pipeline failed to initialize due to Stage resources not being available, or any other internal error. +IVS Composition State Change | Session Failure | A Composition pipeline failed due to a stage being deleted, one or more outputs failing, or any other internal error. @@ -37,2 +37,2 @@ IVS Participant Recording State Change | Recording End | A publisher has disconn -IVS Participant Recording State Change | Recording Start Failure | A publisher connects to the stage, but recording fails to start due to errors (for example, the S3 bucket does not exist or is not in the correct region). This publisher's live stream is not recorded -IVS Participant Recording State Change | Recording End Failure | Recording ends with failure, due to errors encountered during recording (e.g., if the attempt to write the media playlist continuously fails). Some objects may still be written to the configured storage location. +IVS Participant Recording State Change | Recording Start Failure | A publisher connects to the stage, but recording fails to start due to errors (e.g., if an S3 bucket is not found or cannot be accessed). This publisher's live stream is not recorded. +IVS Participant Recording State Change | Recording End Failure | Recording ends with failure, due to errors encountered during recording (e.g., if an S3 bucket is not found or cannot be accessed). Some objects may still be written to the configured storage location. @@ -52 +52 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th -**Destination Failure** : This event is sent when an attempt to output to a Destination failed. For example, broadcasting to a channel failed because there was no stream key or another broadcast was happening. +**Destination Failure** : This event is sent when an attempt to output to a Destination failed (e.g., the S3 bucket was not found, access was denied to the S3 bucket, or the stream already exists for an RTMP destination. @@ -70 +70,2 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th - "reason": "eg. stream key invalid" + "error_code": "e.g., AccessDeniedException", + "reason": "e.g., Access denied to S3 bucket. Please verify your bucket policy" @@ -73,0 +75,9 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th +The following table lists `error_code` and `reason` values for Destination Failure events, along with troubleshooting guidance: + +error_code | reason | Troubleshooting Guidance +---|---|--- +ResourceNotFoundException | S3 bucket not found. Please verify your bucket exists. | Verify your S3 bucket exists and is in the correct region. +AccessDeniedException | Access denied to S3 bucket. Please verify your bucket policy. | Verify your S3 bucket policy grants IVS service the necessary permissions. +ConflictException | Stream already exists | Verify no other broadcast is active on the same RTMP destination channel. +InternalServerException | Service internal error | Retry the operation. If the issue persists, contact AWS Support. + @@ -177 +187 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th -**Session Failure** : This event is sent when a Composition pipeline failed to initialize due to Stage resources not being available, no participants being in the stage, or any other internal error. +**Session Failure** : This event is sent when a Composition pipeline failed due to a stage being deleted, one or more outputs failing, or any other internal error. @@ -194 +204,2 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th - "reason": "eg. no participants in the stage" + "error_code": "e.g., DestinationFailure", + "reason": "e.g. One or more outputs failed" @@ -197,0 +209,8 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th +The following table lists `error_code` and `reason` values for Session Failure events, along with troubleshooting guidance: + +error_code | reason | Troubleshooting Guidance +---|---|--- +StageDeleted | Stage has been deleted | Verify the stage exists before starting a composition. +DestinationFailure | One or more outputs failed | Check individual destination errors. +InternalServerException | Service internal error | Retry the operation. If the issue persists, contact AWS Support. + @@ -238 +257 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th - "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z" + "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z", @@ -243 +262 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th -**Recording Start Failure** : This event is sent when a publisher connects to the stage, but recording fails to start due to errors (e.g., the S3 bucket does not exist or is not in the correct region). The publisher's live stream is not recorded. +**Recording Start Failure** : This event is sent when a publisher connects to the stage, but recording fails to start due to errors (e.g., if an S3 bucket is not found or cannot be accessed). The publisher's live stream is not recorded. @@ -260 +279,3 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th - "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z" + "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z", + "error_code": "e.g., AccessDeniedException", + "reason": "e.g., Access denied to S3 bucket. Please verify your bucket policy" @@ -264 +285,10 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th -**Recording End Failure** : This event is sent when the recording ends with failure, due to errors encountered during recording (e.g., if the attempt to write a master playlist fails). Some objects may still be written to the configured storage location. +The following table lists `error_code` and `reason` values for Recording Start Failure events, along with troubleshooting guidance: + +error_code | reason | Troubleshooting Guidance +---|---|--- +ResourceNotFoundException | S3 bucket not found. Please verify your bucket exists. | Verify your S3 bucket exists and is in the correct region. +AccessDeniedException | Access denied to S3 bucket. Please verify your bucket policy. | Verify your S3 bucket policy grants IVS service the necessary permissions. +ValidationException | Video codec not supported for recording | Verify the publisher is using a supported video codec. +InternalServerException | Service internal error | Retry the operation. If the issue persists, contact AWS Support. + +**Recording End Failure** : This event is sent when the recording ends with failure, due to errors encountered during recording (e.g., if an S3 bucket is not found or cannot be accessed). Some objects may still be written to the configured storage location. @@ -281,2 +311,4 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th - "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z" - "recording_duration_ms": 547327 + "recording_s3_key_prefix": "<stage_id>/<session_id>/<participant_id>/2024-01-01T12-00-55Z", + "recording_duration_ms": 547327, + "error_code": "e.g., AccessDeniedException", + "reason": "e.g., Access denied to S3 bucket. Please verify your bucket policy" @@ -285,0 +318,8 @@ You can create a rule that triggers on an event emitted by Amazon IVS. Follow th +The following table lists `error_code` and `reason` values for Recording End Failure events, along with troubleshooting guidance: + +error_code | reason | Troubleshooting Guidance +---|---|--- +ResourceNotFoundException | S3 bucket not found. Please verify your bucket exists. | Verify your S3 bucket exists and is in the correct region. +AccessDeniedException | Access denied to S3 bucket. Please verify your bucket policy. | Verify your S3 bucket policy grants IVS service the necessary permissions. +InternalServerException | Service internal error | Retry the operation. If the issue persists, contact AWS Support. +