Profile Photos and Team Logos are required to be publicly accessible (/public/ prefix)

Profile photos and Team Logos are required to be publicly accessible (/public/ prefix) in the S3 bucket. There does not seem to be any architectuural need for this, and causes compliance and policy issues. • Deny public rules cannot be used on the bucket - This is a compliance issue for us, but may be a Org policy issue for many other orgs • Cannot use KMS key for encryption on the S3 bucket, because sigV4 doesnt allow anonomous access, even if bucket policy allows public access. - AWS managed encryption keys must be used - This restricts us to hosting in aws govcloud and may be a Org Policy issue for other orgs Solution • Separate bucket for public assets • Or the app serves these assets similar to assets in documents. Impact • If Deny Public Rules or Customer KMS keys are used on the S3 bucket - Profile Photos and Team Logos can be uploaded, and the GUI displays success - Photos and Logos are then not di…