Introduction
Amazon Simple Storage Service (S3) can be used as an origin for CDNsun. The correct CDNsun workflow depends on whether the bucket contains ordinary files or an HLS or DASH stream.
This guide covers publicly readable static objects such as images, stylesheets, JavaScript files, fonts, downloads, and prepared streaming files.
Choose the CDNsun workflow
- Use a CDN Static Pull service for images, CSS, JavaScript, fonts, software downloads, and other files retrieved directly from S3. A CDN Static service can also deliver prepared HLS or DASH files as ordinary HTTP objects.
- Use an HLS Pull Publishing Point with a CDN HTTP Live service when S3 contains an HLS or DASH stream that should use the CDNsun streaming workflow. For HLS, the bucket contains the existing .m3u8 playlists and media segments; S3 does not create or transcode the stream.
Prepare the Amazon S3 origin
Use the regional virtual-hosted-style endpoint
Find the AWS Region of the bucket and construct its origin hostname in this format:
bucket-name.s3.region.amazonaws.com
For example, a bucket named my-static-assets in eu-central-1 uses these addresses:
Origin Domain: my-static-assets.s3.eu-central-1.amazonaws.com Object URL: https://my-static-assets.s3.eu-central-1.amazonaws.com/assets/app.css
AWS documents this as the virtual-hosted-style URL format. Use the exact Region assigned to the bucket. Enter only the hostname as the CDNsun Origin Domain, without https://, an object path, or a trailing slash.
Allow read access to the static objects
CDNsun must be able to retrieve every S3 object it serves, including all playlists and segments used by a stream. For this public-origin setup, a request to the S3 object URL must succeed without AWS credentials. New S3 buckets are private and have Block Public Access enabled by default, so review the bucket and account-level settings before adding a public read policy.
Expose only content intended for public delivery. The following example grants anonymous s3:GetObject access only to objects under the assets/ prefix. Replace my-static-assets and the prefix with your values:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadForCdnAssets",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-static-assets/assets/*"
}
]
}
Do not grant public s3:PutObject, s3:DeleteObject, or s3:ListBucket permissions. AWS explains the security implications and applicable controls in its Block Public Access documentation and provides additional bucket policy examples.
For a CDN Static Pull service, you can optionally restrict S3 read access to requests from CDNsun edge IP ranges by adding an aws:SourceIp condition to the bucket policy. Retrieve the current ranges from the CDNsun API using Get CDN Locations IP ranges.
For CDN HTTP Live, the HLS Pull Publishing Point retrieves the stream from S3 instead of the CDN edge servers. If the S3 bucket policy restricts source IP addresses, resolve the Publishing Server hostname used by the Publishing Point and allow its IP address. The CDN Locations IP ranges are not used for this workflow.
Before creating the CDN service, verify a real object directly at the S3 origin:
curl -I https://my-static-assets.s3.eu-central-1.amazonaws.com/assets/app.css
The object must return a 200 response. A 403 response normally means that the bucket policy, object permissions, or an effective Block Public Access setting still prevents anonymous reads.
Set Content-Type and Cache-Control metadata
Set the correct Content-Type for each object so browsers interpret it correctly. Examples include text/css for CSS, application/javascript for JavaScript, and the appropriate image or font media type for those files.
Also set Cache-Control according to the way the object is updated. A versioned filename that changes whenever its content changes can use a long lifetime:
Cache-Control: public, max-age=31536000, immutable
If the same object URL will be overwritten, use a shorter lifetime such as:
Cache-Control: public, max-age=3600
The following AWS CLI example uploads one stylesheet with explicit metadata:
aws s3 cp app.css s3://my-static-assets/assets/app.css \ --content-type "text/css; charset=utf-8" \ --cache-control "public, max-age=3600"
Amazon S3 stores these HTTP response headers as object metadata. If you change metadata on an existing object, S3 replaces the object with a copy containing the new values. See the AWS documentation for object metadata and editing object metadata. For details about how origin headers and CDN service settings control caching, see Setting a Cache Expiry Time.
Configure CORS when required
CORS is not required for every static file. Configure it when browsers must make cross-origin requests to the CDN hostname, for example for fonts or application code that uses the Fetch API. In the S3 console, open the bucket, go to Permissions > Cross-origin resource sharing (CORS), and add a rule for the website that will use the assets:
[
{
"AllowedHeaders": ["*"],
"AllowedMethods": ["GET", "HEAD"],
"AllowedOrigins": ["https://www.example.com"],
"ExposeHeaders": ["ETag"],
"MaxAgeSeconds": 3600
}
]
Replace https://www.example.com with the actual website origin. Prefer an explicit trusted origin instead of *. AWS describes the supported fields in its S3 CORS documentation. For CDN-specific background, see Using custom fonts with CDN - setting CORS.
Create the CDNsun service
Option A: CDN Static Pull
-
Sign in to CDNsun and go to Services > New Service > Static.
-
Configure the service with these values:
Service Domain: cdn.example.com Origin Domain: my-static-assets.s3.eu-central-1.amazonaws.com Origin Protocol: HTTPS
Replace the example domains and Region with your real values. Do not include a URL scheme or object path in the Origin Domain.
-
Create the service and follow the generated Services/How-To instructions to configure its DNS record and SSL. For the complete service setup, see Creating a CDN Static service.
Option B: CDN HTTP Live for HLS or DASH
Use this option when the bucket already contains a stream. An HLS source normally consists of one or more .m3u8 playlists and the media segments referenced by those playlists. Every referenced object must be publicly readable from its S3 URL.
-
Verify the source playlist and at least one referenced segment directly on S3. Both requests must return 200.
curl -I https://my-static-assets.s3.eu-central-1.amazonaws.com/hls/live/playlist.m3u8 curl -I https://my-static-assets.s3.eu-central-1.amazonaws.com/hls/live/segment-001.ts
-
Set the correct object metadata. Use application/vnd.apple.mpegurl for .m3u8 playlists and video/mp2t for .ts segments. Do not give a frequently updated live playlist the long immutable Cache-Control value intended for versioned static files.
-
Go to Services > Publishing Points, create a Publishing Point with HLS Pull as its input method, and provide the S3 HLS source requested by the form. See Creating a Publishing Point.
-
Go to Services > New Service > HTTP Live, enter the playback Service Domain, and select the new HLS Pull Publishing Point as the Origin Publishing Point. Create the service and follow its Services/How-To instructions. See Creating a CDN HTTP Live service.
Test delivery through CDNsun
CDN Static Pull
Request the same object path through the CDN Service Domain:
curl -I https://cdn.example.com/assets/app.css
The CDN URL must return 200 and the expected Content-Type and Cache-Control headers. Request the URL again and inspect the CDN response headers. An X-Cache: HIT response means the object was served from CDN cache. You can also inspect the URL with CDNsun Curl Online.
After the test succeeds, update the website or application to use the CDN hostname for public static objects:
https://cdn.example.com/assets/app.css https://cdn.example.com/assets/logo.svg
CDN HTTP Live
Open the playback URL shown in Services/How-To with an HLS-compatible player. You can also inspect the playlist response before playback:
curl -I https://stream.example.com/path/to/playlist.m3u8
The playlist and its referenced segments must return 200.
Update and purge cached objects
The preferred update method is to publish changed assets under a new versioned filename, such as app.a1b2c3.css, and then update the application reference. This allows long cache lifetimes without serving an older file under the same URL.
If you overwrite an existing S3 object, open the CDNsun service and use Purge for its exact CDN path, for example:
/assets/app.css
Purge All is normally unnecessary for a single update. Purge only the changed paths, then request them again so CDNsun retrieves the current object and metadata from S3. See Purging and prefetching CDN content for details.