Amazon S3在线课程视频安全桶策略及WordPress播放器咨询

Nice one—this is exactly the kind of setup we see for course platforms mimicking Udemy, so let's break this into two clear parts: locking down your S3 bucket properly, and picking the right WordPress player to tie it all together.

First, let's lay down non-negotiable ground rules to hit your requirements:

• Your bucket must be 100% private (enable all 4 Block Public Access settings—no exceptions)
• Never expose direct S3 object URLs to anyone; use pre-signed URLs generated dynamically only for authorized paid users
• Combine bucket policies with request restrictions to block unauthorized sharing of valid pre-signed URLs

Step-by-Step Bucket Policy Configuration #

Replace your existing policy with this (fill in your custom values where marked):

{
  "Version": "2012-10-17",
  "Id": "CourseVideoAccessPolicy",
  "Statement": [
    // Deny ALL access that doesn't meet our security rules
    {
      "Sid": "DenyUnauthorizedRequests",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR-COURSE-VIDEOS-BUCKET/*",
      "Condition": {
        "StringNotEquals": {
          "aws:Referer": "https://your-wordpress-domain.com/*"
        },
        "StringNotLike": {
          "aws:PrincipalArn": "arn:aws:iam::YOUR-AWS-ACCOUNT-ID:user/YOUR-PRESIGN-GENERATOR-USER"
        }
      }
    },
    // Allow our dedicated IAM user to generate valid pre-signed URLs
    {
      "Sid": "AllowPresignUserFullAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::YOUR-AWS-ACCOUNT-ID:user/YOUR-PRESIGN-GENERATOR-USER"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR-COURSE-VIDEOS-BUCKET/*"
    }
  ]
}

Key Policy Breakdown: #

• Version 2012-10-17: Ditch the old 2008 version—this is the modern, more secure policy schema
• Deny Statement: This is your first line of defense. It blocks:
  • Any request not originating from your WordPress domain (via the aws:Referer check)
  • Any request not initiated by your dedicated IAM user (the one that generates pre-signed URLs)
• Allow Statement: Grants the IAM user permission to fetch bucket objects, which is required to generate valid pre-signed URLs

Critical Anti-Download Add-On #

When generating pre-signed URLs (via AWS SDK in your WordPress code), add these response headers to force playback instead of download:

// Example using AWS SDK for PHP
$command = $s3Client->getCommand('GetObject', [
    'Bucket' => 'YOUR-COURSE-VIDEOS-BUCKET',
    'Key' => 'path/to/your/video.mp4',
    'ResponseContentDisposition' => 'inline; filename="your-video-title.mp4"',
    'ResponseContentType' => 'video/mp4'
]);

// Set URL expiration (adjust based on your course access rules)
$presignedUrl = $s3Client->createPresignedRequest($command, '+24 hours')->getUri();

• ResponseContentDisposition: inline: Forces the browser to play the video directly instead of triggering a download prompt
• Expiration (+24 hours): Limits how long the URL is valid—you could set this to 1 hour for single lesson access, or 7 days for full course access

You need a player that works with dynamic pre-signed URLs, blocks casual downloads, and integrates with your membership system. Here are the top picks:

1. MemberPress Video (Best for Out-of-the-Box Integration) #

• Built specifically for paid courses, so it ties directly to MemberPress's membership tiers
• Auto-generates S3 pre-signed URLs for authorized users
• Disables right-click download options and prevents video embedding on external sites
• Supports HLS streaming for adaptive bitrate playback (great for varying internet speeds)

2. WP Video Player (Flexible, No Membership Lock-In) #

• Supports custom video URLs (including pre-signed ones)
• Lets you disable right-click, hide download buttons, and restrict playback to logged-in users
• Works with most membership plugins (WooCommerce Memberships, Restrict Content Pro) via shortcode conditions

3. ACF + Video.js (Custom Code Option) #

• For full control, use Advanced Custom Fields to store S3 video paths
• In your theme template, check if the user is a paid member via your membership plugin's API
• If authorized, generate the pre-signed URL and render it with Video.js (add custom CSS to disable right-click)

• Use CloudFront (Optional but Recommended): For high-traffic sites, put CloudFront in front of S3. Signed CloudFront URLs are more secure and cacheable than S3 pre-signed URLs, and you can add additional restrictions like geo-blocking.
• Frontend Restrictions Are Just a Layer: Never rely solely on disabling right-click—tech-savvy users can still inspect the DOM. The S3 policy and pre-signed URL expiration are your real security barriers.
• Rotate IAM Keys: Regularly rotate the access keys for your pre-signed URL generator user to prevent unauthorized access if keys are leaked.

内容的提问来源于stack exchange，提问作者John