aws-media-services
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- Security Best Practices Integration: The skill proactively instructs the agent to use AWS Secrets Manager for storing sensitive information like SRT passphrases and DRM credentials, rather than embedding them in scripts or API calls. It also emphasizes the importance of using ephemeral credentials (IAM roles) over static access keys.
- Least-Privilege Enforcement: It explicitly forbids the use of broad IAM policies (e.g., 'Resource: *') and requires that policies be scoped to specific resource ARNs. It also identifies that certain 'FullAccess' managed policies are intended for human operators and should not be attached to service roles.
- Access Control and Protection: The instructions provide detailed guidance on configuring CloudFront Origin Access Control (OAC) with SigV4 signing to protect MediaPackage and S3 origins. This approach is recommended over legacy shared-secret headers to prevent spoofing and unauthorized access.
- Operational Guardrails: The skill includes specific checks to prevent accidental service disruption, such as requiring explicit user confirmation before deleting MediaPackage endpoints that might be serving active traffic.
- Resource Validation: It mandates a rules-based review of proposed configurations (e.g., codec compatibility, GOP alignment) before implementation, ensuring that the agent's actions are both correct and secure within the AWS environment.
Audit Metadata