AWS Video Streaming Project.

One private EC2 instance loops Big Buck Bunny and pushes it over SRT, encrypted end to end. A second, public-facing instance receives that feed, relays it internally, repackages it as HLS/DASH, and serves it to you here — over HTTPS.

Live HLS · /hls/stream.m3u8

Signal chain

01 · PRIVATE SUBNET

Video Streamer

ffmpeg, loop + encode

02 · TRANSPORT

SRT chiffré :9000

AES + passphrase, UDP

03 · PUBLIC SUBNET

Web Frontend

relais SRT→RTMP local

04 · DELIVERY

HTTPS :443

Let's Encrypt + HSTS

05 · YOU

This browser

hls.js playback

What's actually running

The whole environment is provisioned by Terraform creating EC2 instances on a VPC with a public subnet hosting the frontend server and a private subnet hosting the Video Streamer. Security groups and NAT Gateway prevent the Video Streamer to have access from the internet at all. Ansible then configures both machines: ffmpeg pushing an encrypted SRT feed on one side, nginx with the RTMP module relaying it locally and a Let's Encrypt certificate on the other. Both hosts run a mirrored host-level firewall (UFW), Fail2ban against SSH brute-force, and a Wazuh agent reporting to our SOC.

TerraformAnsibleAWS EC2 nginx-rtmpffmpegSRT Let's EncryptUFWFail2ban WazuhHLSDASH

Defense in depth

✓SRT, encrypted — The Streamer→Frontend feed is AES-encrypted, not plaintext RTMP.
✓UFW — Host-level UFW, mirrored to the AWS Security Groups.
✓Fail2ban — To ban IP addresses trying SSH brute force attacks.
✓NAT Gateway — Only for the Video Streamer outbound traffic (video download, apt update).
✓WAZUH — Wazuh agent on each host sending alerts to a SOC.
✓HSTS enabled — Browsers refuse to ever fall back to plain HTTP.
✓Let's Encrypt — Certificate renewed automatically with Snap Timer.

Pour aller plus loin

→GuardDuty — détection de menaces au niveau du compte AWS.
→VPC Flow Logs — capture du trafic réseau pour investigation post-incident.
→CloudTrail — audit de toutes les actions API sur le compte.
→AWS SSM — pour s'affranchir des ouvertures de port SSH.
→Ansible Vault — chiffrement du fichier secrets.yaml contenant la passphrase, afin de le committer en toute sécurité.
→unattended-upgrades — correctifs de sécurité Ubuntu appliqués automatiquement (l'AMI étant figée, rien ne se met à jour tout seul sinon).
→Checkov — analyse statique du code Terraform, détecte les mauvaises configurations de sécurité avant même le déploiement.
→Gitleaks — détecte les secrets (clés, mots de passe) accidentellement committés dans l'historique Git.

Checkov et GitLeaks : les intégrer en pre-commit, afin de repérer les vulnérabilités et les fuites de secrets directement à la source, avant qu'ils n'atteignent le dépôt.