AWS mediatailor documentation change

Service: mediatailor · 2025-08-16 · Documentation medium

File: mediatailor/latest/ug/security_iam_troubleshoot.md

Summary

Added new section 'MediaTailor cannot access my Amazon S3 bucket' with troubleshooting steps for S3 permissions, HTTPS access, and cross-account configurations

Security assessment

The changes add documentation on configuring proper S3 bucket policies, IAM roles, and enforcing HTTPS to secure access to MediaTailor resources. While these are security best practices, there's no indication they address a specific existing security vulnerability.

Diff

diff --git a/mediatailor/latest/ug/security_iam_troubleshoot.md b/mediatailor/latest/ug/security_iam_troubleshoot.md
index 78069b7d5..a0aa7df62 100644
--- a//mediatailor/latest/ug/security_iam_troubleshoot.md
+++ b//mediatailor/latest/ug/security_iam_troubleshoot.md
@@ -5 +5 @@
-I am not authorized to perform an action in MediaTailorI am not authorized to perform iam:PassRoleI want to allow people outside of my AWS account to access my MediaTailor resources
+I am not authorized to perform an action in MediaTailorI am not authorized to perform iam:PassRoleI want to allow people outside of my AWS account to access my MediaTailor resourcesMediaTailor cannot access my Amazon S3 bucket
@@ -18,0 +19,2 @@ Use the following information to help you diagnose and fix common issues that yo
+  * MediaTailor cannot access my Amazon S3 bucket
+
@@ -68,0 +71,147 @@ To learn more, consult the following:
+## MediaTailor cannot access my Amazon S3 bucket
+
+If MediaTailor returns errors when trying to access content from your Amazon S3 bucket, check the following common causes:
+
+### Amazon S3 permissions issues
+
+**Error symptoms:**
+
+  * `502 BadGatewayException` with Amazon S3 related messages
+
+  * `403 Forbidden` errors in MediaTailor logs
+
+  * Content fails to load from Amazon S3 origin
+
+
+
+
+**Resolution:**
+
+  1. Verify your MediaTailor service role has the required Amazon S3 permissions:
+
+JSON
+    
+
+****
+    
+    
+        {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetObject",
+                    "s3:GetObjectVersion"
+                ],
+                "Resource": "arn:aws:s3:::your-vod-bucket/*"
+            },
+            {
+                "Effect": "Allow", 
+                "Action": [
+                    "s3:ListBucket"
+                ],
+                "Resource": "arn:aws:s3:::your-vod-bucket"
+            }
+        ]
+    }
+    
+
+  2. Check your Amazon S3 bucket policy allows MediaTailor access:
+
+JSON
+    
+
+****
+    
+    
+        {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws:iam::111122223333:role/MediaTailorServiceRole"
+                },
+                "Action": [
+                    "s3:GetObject",
+                    "s3:GetObjectVersion"
+                ],
+                "Resource": "arn:aws:s3:::your-vod-bucket/*"
+            }
+        ]
+    }
+    
+
+
+
+
+### HTTPS access issues
+
+**Error symptoms:**
+
+  * SSL/TLS handshake failures
+
+  * `502 Bad Gateway` when accessing HTTPS Amazon S3 URLs
+
+
+
+
+**Resolution:**
+
+  1. Ensure your Amazon S3 bucket policy requires HTTPS:
+
+JSON
+    
+
+****
+    
+    
+        {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Deny",
+                "Principal": "*",
+                "Action": "s3:*",
+                "Resource": [
+                    "arn:aws:s3:::your-vod-bucket",
+                    "arn:aws:s3:::your-vod-bucket/*"
+                ],
+                "Condition": {
+                    "Bool": {
+                        "aws:SecureTransport": "false"
+                    }
+                }
+            }
+        ]
+    }
+    
+
+  2. Verify MediaTailor configuration uses HTTPS URLs for Amazon S3 content.
+
+
+
+
+### Cross-account Amazon S3 access
+
+**Error symptoms:**
+
+  * `Access Denied` errors when Amazon S3 bucket is in different account
+
+  * MediaTailor cannot assume cross-account roles
+
+
+
+
+**Resolution:**
+
+  1. Update the Amazon S3 bucket policy in the content account to trust MediaTailor's service role
+
+  2. Add cross-account permissions to MediaTailor's service role
+
+  3. Ensure both accounts have proper trust relationships configured
+
+
+
+