i am trying to set up egress service (for recording audio) on amazon ecs. my question is, do i have to set up the configuration in the task definition, or can i use a yaml file instead

Thanks for reaching out, Jason. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.

what is the right format for the api_key and api_secret? could you give me an example of a yaml file with placeholders?

The

api_key

and

api_secret

in the LiveKit Egress YAML configuration are string values used for authentication. Here’s a helpful example YAML file with placeholders to guide you:

# Required fields
api_key: "YOUR_API_KEY"                     # Replace with your LiveKit API key
api_secret: "YOUR_API_SECRET"               # Replace with your LiveKit API secret
ws_url: "<wss://your-livekit-server.com>"     # WebSocket URL of your LiveKit server
redis:
  address: "redis-host:6379"                 # Redis server address used by LiveKit
  # username: "optional-redis-username"
  # password: "optional-redis-password"
  # db: 0

# Optional fields
log_level: info                              # Logging level: debug, info, warn, error
health_port: 8080                            # Port for health checks
prometheus_port: 9090                        # Port for Prometheus metrics
enable_chrome_sandbox: true                  # Enable Chrome sandboxing (recommended)

# Storage configuration (e.g., S3)
s3:
  access_key: "YOUR_S3_ACCESS_KEY"
  secret: "YOUR_S3_SECRET_KEY"
  region: "us-east-1"
  bucket: "your-output-bucket"

Just replace the placeholders like

YOUR_API_KEY

and

YOUR_API_SECRET

with your actual credentials. If you have any questions or need a hand with this, feel free to reach out—I’m here to help! Sources: Self-hosting the Egress Service | LiveKit Docs | pkg/config/base.go

does the number of spaces after each colon matter?

When you're working with the YAML configuration for LiveKit Egress, it's important to have a single space after the colon to separate the key from the value. While using multiple spaces won't cause any issues, sticking to just one space helps keep everything neat and easy to read. If you have any more questions or need a hand with anything else, feel free to ask—I'm here to help! Sources: pkg/config/base.go | egress/values.yaml

also, my app is currently including s3 credentials in it's calls. if that is the case, do i still need to include those in the yaml?

I understand that dealing with S3 credentials can be a bit tricky, so let's walk through this together. If your application is including S3 credentials in its calls, it's important not to include those credentials in the egress request, as this will cause the request to be rejected for security reasons. Instead, here’s the best way to handle it: • Define the S3 credentials (like

access_key

,

secret

,

region

,

bucket

) directly in the YAML configuration file under the

s3

section. • If you’re using AWS IAM roles or instance profiles, you can actually leave the credentials out of the YAML file altogether, since the service will automatically use the instance’s assigned IAM role for authentication. Just a quick note: credentials included in application calls won’t replace those set in the YAML configuration. If anything feels unclear or you’d like me to help you step-by-step, please don’t hesitate to reach out—I’m here to help! Sources: auth/grants_test.go | Self-hosting the Egress Service | LiveKit Docs | test/runner.go

how would i use IAM roles for authentication?

To help you use IAM roles for authentication in LiveKit Egress with S3 storage, here’s a simple guide you can follow: 1. Create an IAM Role: Start by creating an IAM role in AWS that has permission to write to your S3 bucket. Make sure to set up a trust policy so the LiveKit Egress service can assume this role. 2. Configure the Role in YAML: Next, add the

assume_role_arn

and

assume_role_external_id

fields in your YAML configuration under the

s3

section. Here’s an example to guide you:

s3:
  region: "us-west-2"
  bucket: "my-egress-bucket"
  assume_role_arn: "arn:aws:iam::123456789012:role/LiveKitEgressRole"
  assume_role_external_id: "external-id-123"

1. Optional Per-Request Configuration: If you want more flexibility, you can also include

assume_role_arn

and

assume_role_external_id

in individual egress requests. 2. Fallback Mechanism: And just so you know, if no access key and secret are provided, the service will automatically use the IAM role assigned to the instance, if that’s available. If you have any questions or need a hand setting up the IAM role or tweaking the YAML configuration, please don’t hesitate to reach out. I’m here to help! Sources: auth/grants_test.go | pkg/config/base.go | Egress & Media Processing | livekit/livekit_composite | DeepWiki | Egress output types | LiveKit Docs

wait - if i use an iam role for the instance, that has the right s3 permissions, what if anything needs to be in my yaml file regarding s3?

If you're using an IAM role for your instance that already has the right S3 permissions, you actually don’t need to include

access_key

or

secret

in your YAML file. A simple S3 configuration would look like this:

s3:
  region: "us-west-2"  # AWS region of your S3 bucket
  bucket: "my-egress"  # Name of your S3 bucket

This way, the LiveKit Egress service will use your instance’s IAM role to handle authentication smoothly. If you have any questions or want me to walk you through it, just let me know—I’m here to help! Sources: pkg/config/base.go

should the region and the bucket actually be in quotation marks in the yaml file?

When setting up your YAML configuration for LiveKit Egress, you don’t have to put the

region

and

bucket

values in quotation marks unless they include special characters or might be unclear. Both of these ways work perfectly:

# Without quotation marks
region: us-east-1
bucket: mybucket

# With quotation marks
region: "us-east-1"
bucket: "my-egress"

Feel free to choose whichever style feels right to you or matches the rest of your configuration. If you have any more questions or need a hand with anything else, just let me know—I’m here to help! Sources: config.go | README.md | egress-sample.yaml

can you tell me how to set up my ecs task now? what i currently have is an environment variable called EGRESS_CONFIG_FILE which has a value of /app/config/egress-config.yaml then i have a volume mounted called egress-config-volume which points to a file system id of listenful-egress-config on EFS and my egress-config.yaml file is mounted there. the task has an iam role which has full s3 access

Let's walk through setting up your ECS task for LiveKit Egress with the configuration you have. Here’s a step-by-step guide to help you get everything up and running smoothly: 1. Prepare the Egress Configuration File: Make sure your

egress-config.yaml

includes all the necessary fields. For S3 access using the IAM role, leave

access_key

,

secret

, and

region

empty. Here’s an example to guide you:

api_key: your-livekit-api-key
api_secret: your-livekit-api-secret
ws_url: <wss://your-livekit-server-url>
redis:
  address: your-redis-host:6379
s3:
  access_key: ""
  secret: ""
  region: ""
  bucket: "your-s3-bucket-name"

1. Mount the EFS Volume: In your ECS task definition, set up the EFS volume like this:

"volumes": [
  {
    "name": "egress-config-volume",
    "efsVolumeConfiguration": {
      "fileSystemId": "fs-xxxxxxxx",
      "rootDirectory": "/",
      "transitEncryption": "ENABLED"
    }
  }
]

Then, don’t forget to mount it in your container definition:

"mountPoints": [
  {
    "sourceVolume": "egress-config-volume",
    "containerPath": "/app/config",
    "readOnly": false
  }
]

1. Set the Environment Variable: Add

EGRESS_CONFIG_FILE

to your container definition to point to your config file:

"environment": [
  {
    "name": "EGRESS_CONFIG_FILE",
    "value": "/app/config/egress-config.yaml"
  }
]

1. Assign the IAM Role: Make sure your ECS task has an IAM role with the right S3 permissions, and reference it like this:

"taskRoleArn": "arn:aws:iam::123456789012:role/ecs-livekit-egress-role"

1. Enable Chrome Sandbox (if needed): If your setup requires it, add the

SYS_ADMIN

capability for Chrome sandboxing:

"linuxParameters": {
  "capabilities": {
    "add": ["SYS_ADMIN"]
  }
}

1. Allocate Resources: It’s important to allocate enough resources—set at least 4 CPUs and 4 GB memory for your task:

"cpu": "4096",
"memory": "4096"

If you have any questions or want me to walk you through any of these steps in more detail, just let me know. I’m here to help! Sources: Self-hosting the Egress Service | LiveKit Docs | test/runner.go

for the mount points, is it ok if readOnly is true?

I don't have the answer you're looking for. You could also try asking your question: • in one of the other Slack channels or • to https://deepwiki.com/livekit/livekit_composite which is trained on all LiveKit source code If you find the answer, please post it here to help others!

_"Our egress service is reading the config file correctly (connects to Redis as configured), but it's not binding to the configured API port 7880. Only the health_port 9090 is listening. The config shows

port: 7880

and

health_port: 9090

. Why would egress ignore the main API port setting while respecting other config values?"_