Using a Cloud Storage Bucket as a Stream Origin

Live Streaming CDN (HLS) can also pull an HLS/DASH manifest and its segments directly from a cloud storage bucket (Amazon S3 or an S3-compatible service), the same way Web CDN can. The configuration method is different, though: instead of a separate signing settings panel, storage credentials for a private bucket are embedded directly in the origin stream URL itself, using the s3:// or s3s:// scheme.

TIP

If your bucket allows public read access, you don't need any of this — just use a plain http:// or https:// origin URL as usual.

URL format

s3://<ACCESS_KEY>:<SECRET_KEY>@<bucket>.<provider-hostname>/path/to/playlist.m3u8
s3s://<ACCESS_KEY>:<SECRET_KEY>@<bucket>.<provider-hostname>/path/to/playlist.m3u8

• s3:// connects to the origin over plain HTTP (port 80); s3s:// connects over HTTPS (port 443, TLS) — use s3s:// unless your storage provider doesn't support TLS
• <bucket> is derived from the first label of the hostname, so use the bucket's virtual-hosted-style hostname (<bucket>.<provider-domain>), the same requirement as Web CDN's cloud storage origin
• <ACCESS_KEY> / <SECRET_KEY> — your storage access key ID and secret access key. If either contains reserved URL characters (:, /, @, ?, #), percent-encode them so the URL parses correctly
• Requests to the origin are signed with AWS Signature Version 2

Setting it up

The Setup New Service form accepts an s3:// or s3s:// origin URL directly — there's no need for a placeholder http:///https:// stream first.

1. Log in to ByteArk Fleet (opens new window), click Setup New Service, choose Live Streaming CDN, then Yes, I have existing streaming URL.
2. Enter your bucket's s3:// or s3s:// URL with embedded credentials as shown above for Origin Stream.
3. Click Setup.

TIP

The Access Key stays visible in the Streams list afterward; the Secret Key is masked as **** once saved.

WARNING

If you add more than one stream URL from the same bucket hostname (via the Streams panel on the service page), only the credentials on the first stream added for that host take effect — credentials on later streams to the same host are ignored. Make sure the first s3:///s3s:// URL you add for a given bucket carries valid credentials.

Troubleshooting

• 403 Forbidden from the origin — verify the Access Key and Secret Key, confirm the bucket's region still accepts Signature V2 requests, and make sure any /, @, or : characters in the secret are percent-encoded.