awslabs / amazon-kinesis-video-streams-webrtc-sdk-js

JS SDK for interfacing with the Amazon Kinesis Video Streams Signaling Service.
https://awslabs.github.io/amazon-kinesis-video-streams-webrtc-sdk-js/examples/index.html
Apache License 2.0
286 stars 141 forks source link

Master and viewer don't get cut off when the STS session token is expired #235

Closed ikramcheb closed 1 year ago

ikramcheb commented 1 year ago

We used STS tokens to connect a master and a viewer to a channel the validity of the token is set to 15 min When the 15 min is elapsed, we noticed that the master was still streaming the video and the viewer still saw it. We want to cut off the streaming and the viewing when the token expires. What is the best way to do it?

Steps to replicate: I have created an STS token with a Python script. I have defined the permission to access a specific channel likewise: policy_document = { "Version": "2012-10-17", "Statement": [ { "Sid": "KinesisVideoStreamMasterAccess", "Effect": "Allow", "Action": [ "kinesisvideo:*" ], "Resource": channel_arn,
} ] } sts = boto3.client('sts', aws_access_key_id=aws_access_key_id,aws_secret_access_key=aws_secret_access_key) result = sts.assume_role(RoleArn=role_arn, RoleSessionName='webRTCSession', DurationSeconds=duration_seconds, Policy=json.dumps(policy_document))

The resulting access key, secret, and session token were inputted into the KVS test page. Open two test pages one for the master and one for the viewer and provide the same access

After 15 minutes, you will see that the stream is always functional on both pages

sirknightj commented 1 year ago

Authentication is required to establish the connection, but once the connection is established, peers can talk to each other freely (up to the 1 hour hard limit).

You can grab the expiration time from the sts call and close the peer connection once time's up.

Feel free to reach out if you have additional questions!