Storage in your own AWS S3 bucket(s)

You can configure Birdie to store recordings in an Amazon S3 bucket you own. In this configuration, Birdie does not store the recordings on its own servers ; recordings are written into the specified bucket.

In this guide, we'll go through how to configure S3 storage for recordings.

Once you've set up your AWS Account with the specified S3 bucket and IAM Role, please send the details to [email protected], and our team will configure Birdie for you.

S3 bucket configuration requirements

The target S3 bucket to which you want recordings to be stored can be in any AWS region. Create a new bucket that will be dedicated to Birdie as we don't support s3 storage into a sub-directory, and let default values unless you need to change something specifically.

1. Sign in to the AWS Management Console.

2. Navigate to the S3 service.

3. Select the AWS Region where you want the bucket to be created: you must select one of the supported regions listed in the following table.

4. Click "Create bucket".

5. Enter a unique bucket name ( YOUR-BUCKET-NAME).

6. Configure any additional settings as required (e.g., versioning, encryption).

7. Set the bucket permission to « Block public access »

8. Click "Create bucket".

9. Once created add these Cors Settings to you bucket in order to allow uploads to your bucket:

   [
       {
           "AllowedHeaders": [
               "*"
           ],
           "AllowedMethods": [
               "GET",
               "PUT",
               "POST",
               "HEAD"
           ],
           "AllowedOrigins": [
               "https://*.birdie.so"
           ],
           "ExposeHeaders": [],
           "MaxAgeSeconds": 3000
       }
   ]

10. Edit your Bucket policy and add this, replacing YOUR-BUCKET-NAME by the name of your bucket (required for read, uploads and video processing):

    {
        "Version": "2012-10-17",
        "Id": "BirdiePolicy",
        "Statement": [
            {
                "Sid": "BirdieBucketLevelAccess",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::797105367277:root"
                },
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation",
                    "s3:ListBucketMultipartUploads"
                ],
                "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
            },
            {
                "Sid": "BirdieObjectLevelAccess",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::797105367277:root"
                },
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:AbortMultipartUpload",
                    "s3:ListMultipartUploadParts"
                ],
                "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            },
            {
              "Sid": "AllowBirdieMediaConvertBucketLevel",
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::797105367277:role/MediaConvert_Default_Role"
              },
              "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
              ],
              "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
            },
            {
              "Sid": "AllowBirdieMediaConvertObjectLevel",
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::797105367277:role/MediaConvert_Default_Role"
              },
              "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
              ],
              "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            }
        ]
    }

11. Once created please send the Region and Bucket Name to Birdie.

Creating an IAM Policy with appropriate permissions

1. Navigate to the IAM service in the AWS Management Console.

2. Click on "Policies" in the left menu, then "Create Policy" button at the top right.

3. Enable "JSON" tab in the policy editor that opened.

4. Paste this policy, and make sure to replace into the 2 Resource entries YOUR-BUCKET-NAME with your own bucket name.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "PermissionSet1BucketLevel",
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetBucketLocation",
                   "s3:ListBucketMultipartUploads"
               ],
               "Resource": [
                   "arn:aws:s3:::YOUR-BUCKET-NAME"
               ]
           },
           {
               "Sid": "PermissionSet1ObjectLevel",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:DeleteObject",
                   "s3:GetObjectVersion",
                   "s3:DeleteObjectVersion",
                   "s3:AbortMultipartUpload",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::YOUR-BUCKET-NAME/*"
               ]
           }
       ]
   }
   

5. Click the Next button at the bottom of the page.

6. Give your Policy a name, for example "birdie-bucket-policy", then hit the Create policy button.

Creating an IAM Role with the Policy we just created

AWS Identity and Access Management (IAM) is used to control access to various AWS resources, including S3 buckets. To allow Birdie to store recordings into your designated bucket, Birdie's account needs sufficient access to your bucket.

1. Navigate to the IAM service in the AWS Management Console.

2. Click "Roles" in the left menu, and then "Create role".

3. Select « AWS Accounts » and « Another AWS account »

4. Enter Birdie's AWS account ID: 797105367277

5. Click "Next: Permissions".

6. Attach the policy we created at the previous step, in our example we would type "birdie-bucket-policy" in the search field to find our policy in the list. Once found, check the checkbox corresponding to our policy.

7. Click "Next: Tags" and add any tags if needed.

8. Click "Next: Review".

9. Enter a role name (e.g., Birdie-S3-Access-Role).

10. Click "Create role". Verify that your Trust Policy look like this:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::797105367277:root"
                },
                "Action": "sts:AssumeRole"
            }
        ]
    }

11. Once created send to Birdie the new role ARN that can be found on the main role page. If you’re hesitating, here is a random example of ARN: arn:aws:iam::987654321098:role/my-role

Put together you should provide Birdie with 3 informations:

Before sending us the information, ensure that the bucket testing on https://app.birdie.so/test-s3 is successful.

• AWS Role ARN: The unique IAM Role ARN, that will be dedicated for Birdie.

• Bucket Name: The name of your Amazon S3 bucket.

• Region: The AWS region where your S3 bucket resides, such as us-east-1

Conclusion

We hope this guide was helpful in showing you how to store your recordings in your own S3 bucket. If you have any questions or run into any issues with the setup, please contact us at [email protected].