cdk-private-asset-bucket 1.143.2

Construct to create a private asset S3 bucket. A cognito token can be used to allow access to he S3 asset.

cdk-private-asset-bucket

A construct to create a private asset S3 bucket. Cognito will be used for token validation with Lambda@Edge.

Architecture

Test PrivateBucketAsset

If you forged / cloned that repo you can test directly from here. Don't forget to init with:

yarn install

Create a test cdk stack with one of the following:

yarn cdk deploy
yarn cdk deploy --watch
yarn cdk deploy --require-approval never

• Upload a picture named like pic.png to the private asset bucket
• Create a user pool user and get / save the token:

USER_POOL_ID=us-east-1_0Aw1oPvD6
CLIENT_ID=3eqcgvghjbv4d5rv32hopmadu8
USER_NAME=martindev
USER_PASSWORD=M@rtindev1
REGION=us-east-1
CFD=d1f2bfdek3mzi7.cloudfront.net

aws cognito-idp admin-create-user --user-pool-id $USER_POOL_ID --username $USER_NAME --region $REGION
aws cognito-idp admin-set-user-password --user-pool-id $USER_POOL_ID --username $USER_NAME --password $USER_PASSWORD  --permanent --region $REGION
ACCESS_TOKEN=$(aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id $CLIENT_ID --auth-parameters USERNAME=$USER_NAME,PASSWORD=$USER_PASSWORD  --region $REGION | jq -r '.AuthenticationResult.AccessToken')

echo "curl --location --request GET \"https://$CFD/pic.png\" --cookie \"Cookie: token=$ACCESS_TOKEN\""

• You can use the curl for importing in Postman. but it looks like Postman can't import the cookie. So you need to set the cookie manually in Postman!
• In Postman you should see your picture :)

Planned Features

• Support S3 bucket import ootb.
• Support custom authorizer

Thanks To

• Crespo Wang for his pioneer work regarding private S3 assets https://javascript.plainenglish.io/use-lambda-edge-jwt-to-secure-s3-bucket-dcca6eec4d7e
• As always to the amazing CDK / Projen Community. Join us on Slack!
• Projen project and the community around it