Amazon Cloud App Streaming Details

Important: At this time, Amazon cloud app streaming is available for select apps only.

Amazon cloud app streaming runs Fire OS apps in AWS cloud containers and streams the user interface to Vega OS Fire TV devices. The following sections cover the video playback workflow, content security, app data handling, geographic deployment, IP tunneling, and supported features.

Video playback

The following steps describe how a video play request flows between the Vega OS Fire TV device and the cloud app instance:

Vega OS device sends the user's UI interactions to the app instance running on Fire OS in a cloud container.
Cloud app instance receives a content play request triggered by the user's interaction.
Cloud app instance makes a call to the developer CDN, which is routed to the on-device streaming player.
Cloud app instance uses MediaDRM and MediaCodec interfaces, which are bridged to the device streaming player.
Device media player fetches content from the developer CDN.
Device streaming player sends a non-AV payload to the cloud app instance to synchronize state.
Device streaming player decodes the AV payload through the on-device secure video pipe.
Device sends playback status to the cloud app instance so the cloud-hosted UI stays in sync with the local player.
Cloud app instance streams the UI to the device client.
Device composites the app instance UI with the video content and renders it on screen.

Content security

Amazon cloud app streaming delivers content directly to the device, so it has the same high security as apps running fully local. Cloud app streaming protects content through these mechanisms:

Cloud app streaming supports PlayReady and Widevine.
A DRM client running on the Vega OS device handles playback of DRM-protected content. The DRM client generates the DRM system–specific license request messages. Because the DRM license is individualized for the Vega OS device, only the DRM client on that physical device can decrypt the content keys carried in the DRM license. The cloud container can't decrypt these keys.
The Vega OS device decodes all audio and video content locally, not in the cloud container.
The cloud container running the Fire OS app doesn't retain the DRM system–specific messages. For example, DRM license requests, DRM licenses, and DRM license renewal requests pass through the cloud container during playback but aren't stored after the session ends.

App data handling

Amazon cloud app streaming uses strong data security measures to handle app data with the following practices:

Cloud app streaming collects, accesses, and stores app data on a per device and per user basis.
App data is always encrypted before it leaves the cloud container.
App data is encrypted with keys that are unique to both the device and the user. Cloud streaming stores the encrypted data in persistent storage. This encrypted data is inaccessible when the app isn't in use.
Unencrypted app data only exists in the cloud container's memory during an active session.

Geographic considerations

Amazon cloud app streaming deploys containers in the region that matches the preferred marketplace. For example, cloud streaming deploys a container in the United States (US) for an app in the US marketplace and deploys a container in India (IN) for an app in the IN marketplace. Within a region, users connect to the container server with the lowest latency.

How your back-end services see traffic depends on whether IP tunneling is enabled:

Without IP tunneling – App logic traffic (for example, catalog requests and logins) comes from AWS gateway addresses. Streaming traffic comes from the Vega OS Fire TV device.
With IP tunneling – All traffic comes from the Vega OS Fire TV device.

IP tunneling

Having the Fire OS app running in a cloud container causes your app's back-end services and third-party SDKs to see traffic from a limited set of public AWS gateway IPs instead of from a variety of device IPs. Also, the IP address seen by your content delivery network doesn't align with the IP address seen by your back-end servers. These situations can create challenges including:

Local ad targeting based on IP address might not function correctly.
VPN inhibitors might be falsely triggered.
Other geo-fencing solutions might not function as expected.
High-traffic events might trigger denial of service attack warnings.

To address these problems, apps can be configured to support IP tunneling, where all IP traffic is routed through the device. However, enabling IP tunneling might increase lag in user interactions and reduce the speed of content catalog browsing and other interactions in the app, which is why it isn't enabled by default. If your app is encountering issues like the ones described in this section, contact Developer Support and request that your app be enabled with IP tunneling.

In-App Purchasing

Cloud-streamed apps support Amazon In-App Purchasing. Your existing IAP integration works without modification. The purchase flow behaves the same way it does on a Fire TV Stick 4K Max.

In-app ad SDKs

If your in-app ad SDK runs on Fire OS 7, it should function in cloud app streaming the same way it does on a Fire TV Stick 4K Max. However, if your app requires local targeting based on IP address, contact Developer Support to request your app be enabled with IP tunneling. IP tunneling makes sure that the ad network sees the IP address of the device gateway instead of the AWS cloud gateway.

Fire OS features that aren't supported

As of October 2025, the following features aren't supported for apps running in Amazon cloud app streaming:

Local network and local device access (for example, DLNA, playing content from USB)
Picture in Picture
Fire OS discover and launch
Vega OS home screen live TV EPG integration
Continue watching row references

Last updated: Aug 17, 2026