Cost - Secure Media Delivery at the Edge on AWS
Base module Session revocationAPI ModuleAuto session-revocationMetrics monitoring

Cost

You are responsible for the cost of the AWS services used while running this solution. The total cost for running this solution depends on the selected modules used in the solution and input parameters.

We recommend creating a budget through AWS Cost Explorer to help manage costs. Prices are subject to change. For full details, see the pricing webpage for each AWS service used in this solution.

Note

  • Below cost estimates relate only to the elements created during the deployment of the solution. The charges associated with running the video workload on CloudFront, which must be created independently from this solution, are not included in the cost breakdown.

  • Example cost calculations listed below demonstrate incremental costs incurred from newly created components in your account as an output of the solution.

  • The total charges will also include the video delivery pipeline that consist of costs of running media content origin (for example, Amazon S3, AWS Elemental MediaPackage, among others) and delivery to the viewers through Amazon CloudFront. These costs are not specified below as this solution is designed to complement existing video streaming workloads implemented on Amazon CloudFront.

Assumptions

  • The following examples provide a cost estimate for video streaming workload with 10 live streaming events per month, 60 mins in duration each, and driving 10,000 concurrent viewers. For each viewer, a playback token is generated once, just before the playout starts. It is assumed that during each event, 10 playback sessions are revoked manually, while 20 of them are detected and blocked as a result of automatic session revocation mechanism.

  • Signing key is rotated automatically each day.

  • To calculate the number of CloudFront Function invocations (example):

    1. Number of viewing sessions 10,000 viewers * 10 events = 100,000 sessions

    2. Average viewing duration per session (seconds) 60 minutes * 60 = 3600 seconds

    3. Segment length (seconds) 2 seconds and manifest request after 3 consecutive segment requests (3600/2 + 3600/(2*3) *100000 = 240M invocations

Base module

Cost to validate request tokens and key rotation

AWS service Dimension/month Cost [USD]
CloudFront Functions 240 million invocations $24.00
Secrets Manager 3 secrets API call for 1 in 10 token generation operations Storage per secret per month $1.25 $0.40 * number of keys
Step Functions Number of transitions during key rotation workflow One rotation per day ~ 30/mo < $0.01
Lambda Lambda related costs during key rotation process One rotation per day ~ 30/mo < $0.01
Total monthly cost: ~$25.65 / month
Note

This solution uses secrets key caching implemented in token generation method for Secrets Manager to reduce API calls and cost

Session revocation

(Part of base module but it’s optional to use it)

Cost to block compromised playback sessions

AWS service Dimension/month Cost [USD]
AWS WAF Web ACL + Rule Group + Rules (*it is assumed no WebACL was not used before for video delivery and AWS WAF is associated with CloudFront solely for session revocation purpose) $6.14
AWS WAF Requests – 240 million (*it is assumed no web ACL was not used before for video delivery and AWS WAF is associated with CloudFront solely for session revocation purpose) $144.00
Total monthly cost: ~$150.14 / month

API Module

(Part of core module but it’s optional to use it)

Cost to generate 100,000 of playback tokens per month

AWS service Dimension/month Cost [USD]
API Gateway 100,000 API calls $0.10
DynamoDB 50,000 Read Request Units Assume 1 request = .5 RRU $0.01
CloudFront (fronting API Gateway) (Data Transfer + Request charges) 100,000 HTTP requests with ~1kB response $0.11
Lambda@Edge 100,000 function invocations $0.60
Lambda 100,000 function invocations $0.20
Total monthly cost: ~$0.48 / month
Note

Cost for API calls to Secrets Manager already included in Base module

Auto session-revocation

(In addition to session revocation costs)

Cost to run auto revocation pipeline

AWS service Dimension/month Cost [USD]
Step Functions Number of transitions during session scanning and updating workflow $0.14
Athena CloudFront Access Logs Data Scanned* - 1545GB * (single 1hr playback session produces ~270KB log data) $7.54
AWS WAF Additional rules inserted into Rule Group from Session Revocation $0.27
Total monthly cost: $7.95 / month

Metrics monitoring

Cost of running the solution’s dashboard

AWS service Dimension/month Cost [USD]
CloudWatch - Dashboard Fixed cost for CloudWatch Dashboard $5.00
CloudWatch Logs Insights – Data Scanned Token verification results widget built on CloudWatch Logs insights – 72GB data scanned $0.36
Total monthly cost: ~$5.36 / month

If you choose to deploy the demo website (which we recommend deactivating after you launch the solution in a production environment), the solution automatically deploys Amazon S3 bucket for storing the static website assets in your account, and use the same CloudFront distribution created in front of API Gateway endpoint. You are responsible for the incurred variable charges from these services.