mediastore policy bug found in the aws-cloudfront-mediastore module

[eggoynes]

description of the bug:

The AWS MediaStore policy generated from the construct allows anonymous requests directly to the AWS MediaStore container, and the requests do not have to come through Amazon CloudFront. It looks like the AWS MediaStore policy code is trying to limit access to just the Amazon CloudFront distribution with this code, but I am still able to curl files directly from the AWS MediaStore container.

aws-solutions-constructs/source/patterns/@aws-solutions-constructs/aws-cloudfront-mediastore/lib/index.ts

Lines 86 to 103 in f0a05aa

	policy: JSON.stringify({
	Version: '2012-10-17',
	Statement: [{
	Sid: 'MediaStoreDefaultPolicy',
	Effect: 'Allow',
	Principal: '*',
	Action: [
	'mediastore:GetObject',
	'mediastore:DescribeObject'
	],
	Resource: `arn:${Aws.PARTITION}:mediastore:${Aws.REGION}:${Aws.ACCOUNT_ID}:container/${Aws.STACK_NAME}/*`,
	Condition: {
	Bool: {
	'aws:UserAgent': this.cloudFrontOriginAccessIdentity.originAccessIdentityName,
	'aws:SecureTransport': 'true'
	}
	}
	}]

Reproduction Steps

1. Deploy the contruct

2. Upload files to AWS MediaStore container.

3. curl files directly from MediaStore container.

curl https://somecontainer.data.mediastore.us-east-1.amazonaws.com/my_file

But it should only allow downloading from CFN distribution.

curl https://somecode.cloudfront.com/my_file

How to Fix

I am testing and looking at the code to see what needs to change to fix this.

---

This is 🐛 Bug Report