Host an HLS package on AWS

Design an object prefix

Give each immutable release its own prefix, such as media/course-01/v1/. Upload the extracted ZIP contents under that prefix while preserving every directory.

Versioned keys make rollback and long-lived segment caching safer than replacing unrelated files in one shared folder.

media/course-01/v1/master.m3u8
media/course-01/v1/720p/index.m3u8
media/course-01/v1/720p/segment_000.ts

Keep S3 private when practical

A common design keeps the S3 bucket private and lets CloudFront retrieve objects through Origin Access Control. Public viewers request CloudFront URLs rather than direct S3 object URLs.

Access design depends on whether the package is public or protected; signed URLs or cookies require additional application work.

Set metadata and caching

Assign playlist and segment content types during upload. Immutable versioned segments can use a long cache lifetime, while a playlist overwritten at one key needs a shorter policy or invalidation.

Do not cache a missing-object or HTML error response as if it were media.

• .m3u8: application/vnd.apple.mpegurl
• .ts: video/mp2t
• Test one deep segment URL through CloudFront
• Use HTTPS for the player and media

Validate the distribution URL

Request the master, child playlist, first segment, a middle segment, and final segment. Then test startup and seeking in the intended player.

If the player is on another origin, configure and verify CORS for all media objects. Do not make the bucket public merely to mask a missing CloudFront policy.

Technical references

Primary documentation used to review this guide:

• AWS: Restrict S3 origin access with OAC
• AWS: S3 CORS configuration
• AWS: CloudFront cache behavior settings