Two OTT brands on one governed estate: CloudFront + MediaTailor at multi-$M scale

A streaming service for children carries a compounding governance burden: the estate is large, changes continuously under operations and cost optimization, and its configuration state has safety and compliance weight — encryption, access scoping, and delivery settings are commitments, not defaults. At OTT scale, drift happens in small increments nobody notices: a security-group change during an incident, a bucket policy adjusted for a one-off, a setting that never got rolled back. The platform needed the drift found by machinery, continuously, rather than by the next audit or the next outage.

VeUP delivered configuration governance as a workstream of the broader operational program. AWS Config records the configuration of the estate’s resources and evaluates them continuously, so every deviation from intended state becomes a timestamped, attributable finding rather than latent risk — covering the resources behind the CloudFront/MediaTailor delivery layer as well as the application and data services around them. Findings flow into AWS Security Hub, which centralizes security management for the estate into one queue, and the AWS Backup-based disaster-recovery strategy ensures the platform’s recovery posture is itself governed and testable. The result folds into the same operating rhythm VeUP runs for APMC’s whole account: measured account health, drift caught while it is one resource instead of one hundred, and configuration evidence continuously accumulating for compliance conversations.