AWS for Industries
Aligning AWS to MPA security best practices for media archives – Part 1
Protecting high-value media content, from pre-release films to master recordings, demands rigorous security controls throughout the content lifecycle. The MPA Content Security Best Practices, currently at version 5.3.1 (August 2025), provide the industry-standard framework that media organizations use to safeguard assets against unauthorized access, exfiltration, and tampering. The framework consolidates 82 best practices across four security domains: organizational security (OR), operational security (OP), physical security (PS) and technical security (TS), with each control tagged as site, cloud, or app applicable.
For organizations migrating media archives to the cloud, the question is clear: can your cloud provider meet these exacting standards? Amazon Web Services (AWS) offers a broad set of services that map directly to MPA requirements, providing media companies with what they need to build archive environments that are secure by default and auditable by design.
In this three-part series, we examine how AWS capabilities align with MPA security requirements. Part 1 covers foundational controls such as information security management systems (ISMS), identity and access management, network isolation, encryption, and authorization. Part 2 addresses operational controls: patch management, monitoring, personnel security, data integrity, and business continuity. Finally, Part 3 explores the newest additions to MPA Best Practices like Zero Trust Architecture, artificial intelligence and machine learning (AI/ML) security, cloud misconfiguration prevention, and secure content transfer.
The AWS Shared Responsibility Model
Understanding security boundaries is foundational to mapping MPA controls onto cloud infrastructure. AWS operates under a shared responsibility model that separates “security of the cloud” from “security in the cloud.” AWS protects the underlying infrastructure like hardware, networking, and facilities, while customers configure and manage their workloads on top of it.
For media archives, AWS handles physical data center security (relevant to PS-3.2 and PS-3.3), hardware lifecycle management, and hypervisor-level isolation. Customers own the configuration of access policies (TS-1.7, TS-1.8), encryption settings (TS-3.0), network segmentation (TS-2.5), and personnel controls (OR-3.0 through OR-3.4), but they don’t have to start from scratch. AWS provides purpose-built services for each of these areas:
- AWS Identity and Access Management (IAM) and AWS Organizations for access management
- AWS Key Management Service (AWS KMS) for encryption lifecycle
- Amazon Virtual Private Cloud (Amazon VPC) and AWS Network Firewall for segmentation
- AWS Security Hub for posture validation.
MPA v5.3.1 explicitly addresses this division in controls TS-1.11 (Shared Security Responsibility Model) and TS-1.12 (Cloud Misconfigurations), both covered in Part 3.
The services described throughout this series show how AWS tooling makes the customer’s side of this model achievable and auditable at scale.
ISMS implementation and compliance
MPA Best Practices control OR-2.0 requires organizations to conduct a risk assessment annually, with the additional recommendation to use an accredited third party. Control OR-1.0 mandates that organizations establish and regularly review an ISMS, referencing established frameworks such as ISO 27001, NIST 800-53, SANS, CoBIT, CSA, or CIS.
AWS supports ISMS implementation at both the infrastructure and customer layers. AWS itself holds certification for ISO/IEC 27001:2022, along with 27017:2015, 27018:2019, 27701:2019, and others, meaning the AWS side of the shared responsibility model already satisfies ISMS requirements. For customers building their own ISMS on AWS, several services streamline the process, such as AWS Config conformance packs, which provide a prebuilt standard framework for ISO/IEC 27001:2013 Annex A, enabling automated evidence collection for ISMS audits. AWS Config conformance packs deploy collections of compliance rules as a single entity across an organization, and AWS Security Hub CSPM performs automated security best practice checks as a cloud security posture management service. AWS Organizations with service control policies (SCPs) enforce governance guardrails across all accounts, which means that ISMS policies can’t be bypassed at the individual account level.
Together, these services enable media organizations to demonstrate ongoing compliance with MPA’s ISMS requirements. For more details, refer to the AWS ISO certification page.
Identity and access control: Root access with MFA only
The MPA framework addresses authentication across two controls. TS-1.6 requires unique usernames, multi-factor authentication (MFA) for internet-facing systems and administrative consoles, and lockout after a maximum of five invalid login attempts. TS-2.9 covers remote access specifically, requiring VPN with split tunneling disabled, session termination after 15 minutes of inactivity, AES-256 encryption, and MFA for all remote connections.
The 2026 TPN STAR Report identifies inconsistent MFA enforcement as a persistent gap across the entertainment ecosystem.
AWS has made MFA enforcement mandatory at the platform level. Beginning with AWS Organizations management account root users in May 2024, AWS expanded MFA requirements to standalone accounts in June 2024, then introduced centralized root access management in November 2024, culminating in comprehensive MFA enforcement across all account types in June 2025.
Users must register an MFA device within 35 days of their first sign-in. This means that even the most privileged credential in your AWS environment—the root user—can’t operate without a second authentication factor, addressing the MFA component of both TS-1.6 and TS-2.9.
For TS-2.9’s VPN requirements, AWS Client VPN provides managed OpenVPN-based remote access with split tunneling controls, idle session timeout configuration, and integration with AWS IAM Identity Center for MFA-protected authentication, which covers the control’s requirements for encrypted remote access with session management.
For implementation, AWS provides detailed guidance at the root user best practices page in the IAM documentation and the IAM best practices resource, which recommends requiring MFA for all users with credentials.
Authorization and least privilege
Beyond authentication, MPA control TS-1.7 mandates authorization based on the principle of least privilege with defined user roles, regular access reviews, and immediate revocation upon role changes. Control TS-1.8 requires a formal identity access management process covering provisioning, periodic recertification, and de-provisioning across all personnel types.
AWS provides granular authorization through IAM policies that support both role-based (RBAC) and attribute-based access control (ABAC), enabling content-label-driven permissions for archive assets. AWS Organizations SCPs enforce permission guardrails across all accounts.
For the TS-1.8 lifecycle process, IAM Identity Center provides System for Cross-domain Identity Management (SCIM)-based integration with human resources (HR) systems for automated provisioning and immediate de-provisioning upon role change or departure. IAM Access Analyzer complements this by surfacing unused permissions and generating least-privilege policy recommendations based on actual usage, enabling evidence-based recertification reviews.
Content network isolation
MPA Best Practices control TS-2.5 requires organizations to isolate content and production networks from non-content and non-production networks through physical air gaps or logical segmentation through Layer 2 or Layer 3 virtual local area network (VLAN) access control lists (ACLs). Control TS-2.4 further requires stateful inspection firewalls with ACLs, logging of all traffic and configuration changes, and regular ACL reviews.
AWS provides network isolation services that map directly to both controls. Amazon VPC creates a logically isolated virtual network, and AWS recommends dedicated VPCs for content workloads, with no internet gateway attached, to achieve the logical segmentation TS-2.5 requires. Within each VPC, security groups provide stateful instance-level firewalling satisfying TS-2.4, and network ACLs control traffic at the subnet level. AWS CloudTrail logs all firewall configuration changes for the regular review cadence TS-2.4 mandates. For inter-VPC connectivity, AWS Transit Gateway and AWS PrivateLink enable scalable multi-VPC architectures, and AWS Network Firewall provides stateful traffic inspection between segments.
For media workflows specifically, AWS demonstrates how to set up secure streaming using Amazon API Gateway and AWS Elemental MediaLive with Amazon VPC endpoints and AWS Client VPN, restricting private streams exclusively to a customer’s corporate network without public internet exposure.
Together, this means that content never traverses untrusted networks, which is a core principle of MPA’s network security requirements. For implementation guidance, refer to the Security best practices for your VPC documentation and the Secure media streaming with private networking using AWS Media Services blog post.
Encryption at rest and in transit
MPA Best Practices v5.3.1 addresses encryption under the technical security domain. Control TS-3.0 requires AES-256 encryption at a minimum for content at rest and AES-256 with TLS 1.2 at a minimum for content in motion. Control TS-3.2 covers encryption key management, including out-of-band delivery, rotation schedules, key destruction procedures, and restricted access to key management personnel. The 2026 TPN STAR Report highlights cryptography as one of the weakest-performing control areas across the industry.
AWS meets both requirements. Since January 5, 2023, every new object uploaded to Amazon S3 is automatically encrypted with server-side encryption with AWS KMS keys (SSE-KMS) at no additional cost. For organizations requiring customer managed key control, which is common in studio environments, SSE-KMS allows full lifecycle management through AWS KMS. For encryption in transit, Amazon S3 API endpoints require a minimum of TLS 1.2 as of February 27, 2024. AWS Transfer Family requires TLS 1.2 for all SFTP or FTPS ingestion workflows, and Amazon CloudFront enforces TLS 1.2+ by default for content delivery using its TLSv1.2_2019 security policy on new distributions. AWS KMS integrates with the majority of AWS services to enable encryption both at rest and in transit, and it meets the MPA requirement by enforcing only the strongest current protocol version.
Conclusion
AWS provides a robust foundational security architecture that maps directly to MPA Content Security Best Practices. From ISMS compliance support addressing OR-1.0 and OR-2.0 to mandatory MFA satisfying TS-1.6 and TS-2.9, least-privilege authorization meeting TS-1.7 and TS-1.8, VPC-based network isolation fulfilling TS-2.5 and TS-2.4, and default AES-256 encryption addressing TS-3.0. Media organizations can establish a secure-by-default foundation for their archive environments.
These foundational controls represent the preventive layer of a defense-in-depth strategy. In part 2 of this series, we’ll explore how AWS supports the operational side of MPA compliance—including automated patch management, AI-powered threat detection with CloudTrail and Amazon GuardDuty, personnel security under the shared responsibility model, immutable storage with S3 Object Lock, archive durability, and real-world customer validation from organizations such as Sony Music Entertainment Japan and Warner Bros. Discovery. In part 3, we cover the newest additions to the MPA Best Practices: Zero Trust Architecture, AI/ML security governance, and cloud misconfiguration prevention.
Together, these three posts provide a roadmap for aligning your media archive with industry content security standards.