Skip to main content

MEDIASTORE controls (1)

CTL.MEDIASTORE.POLICY.PUBLIC.001​

MediaStore Container Policy Must Not Allow Public Access

  • Severity: high
  • Type: unsafe_state
  • Domain: exposure
  • Compliance: nist_800_53_r5: AC-3; soc2: CC6.1;

MediaStore container policy grants access to Principal "*" or external accounts without aws:PrincipalOrgID condition. MediaStore containers hold streaming media assets. A public container policy lets any AWS account (or unauthenticated caller if combined with public endpoint) read, overwrite, or delete media objects. Scott Piper's aws_exposable_resources lists mediastore:PutContainerPolicy as a public exposure vector. API: mediastore:GetContainerPolicy.

Remediation: Restrict the container policy to specific account IDs or add an aws:PrincipalOrgID condition. For public content delivery, use CloudFront with an origin access identity instead of a public container policy.