Construct to create a private asset S3 bucket. A cognito token can be used to allow access to he S3 asset.
Project description
cdk-private-asset-bucket
A construct to create a private asset S3 bucket. Cognito will be used for token validation with Lambda@Edge.
Architecture
Example
import { PrivateAssetBucket } from 'cdk-private-assets-bucket';
...
const userPool = new cognito.UserPool(stack, 'userPool', {
removalPolicy: core.RemovalPolicy.DESTROY,
});
const userPoolWebClient = new cognito.UserPoolClient(stack, 'userPoolWebClient', {
userPool: userPool,
generateSecret: false,
preventUserExistenceErrors: true,
authFlows: {
adminUserPassword: true,
userPassword: true,
},
oAuth: {
flows: {
authorizationCodeGrant: false,
implicitCodeGrant: true,
},
},
});
const privateAssetBucket = new PrivateAssetBucket(stack, 'privateAssetBucket', {
userPoolId: userPool.userPoolId,
userPoolClientId: userPoolWebClient.userPoolClientId,
});
new core.CfnOutput(stack, 'AssetBucketName', {
value: privateAssetBucket.assetBucketName,
});
new core.CfnOutput(stack, 'AssetBucketCloudfrontUrl', {
value: privateAssetBucket.assetBucketCloudfrontUrl,
});
Properties
Test PrivateBucketAsset
If you forged / cloned that repo you can test directly from here. Don't forget to init with:
yarn install
Create a test cdk stack with one of the following:
yarn cdk deploy
yarn cdk deploy --watch
yarn cdk deploy --require-approval never
- Upload a picture named like pic.png to the private asset bucket
- Create a user pool user and get / save the token:
USER_POOL_ID=us-east-1_0Aw1oPvD6
CLIENT_ID=3eqcgvghjbv4d5rv32hopmadu8
USER_NAME=martindev
USER_PASSWORD=M@rtindev1
REGION=us-east-1
CFD=d1f2bfdek3mzi7.cloudfront.net
aws cognito-idp admin-create-user --user-pool-id $USER_POOL_ID --username $USER_NAME --region $REGION
aws cognito-idp admin-set-user-password --user-pool-id $USER_POOL_ID --username $USER_NAME --password $USER_PASSWORD --permanent --region $REGION
ACCESS_TOKEN=$(aws cognito-idp initiate-auth --auth-flow USER_PASSWORD_AUTH --client-id $CLIENT_ID --auth-parameters USERNAME=$USER_NAME,PASSWORD=$USER_PASSWORD --region $REGION | jq -r '.AuthenticationResult.AccessToken')
echo "curl --location --request GET "https://$CFD/pic.png" --cookie "Cookie: token=$ACCESS_TOKEN""
- You can use the curl for importing in Postman. but it looks like Postman can't import the cookie. So you need to set the cookie manually in Postman!
- In Postman you should see your picture :)
- For Debugging the Lambda@Edge with Cloudwatch go to the AWS Console --> Cloudwatch --> Log groups --> switch to the region you are closest to --> figure out which log group is correct
Planned Features
- Migrating to cdk v2. If you know a cool workflow how to continuously support v1 and v2 let me know!
- Support S3 bucket import ootb.
- Support custom authorizer
- Leverage Cloudfront Function for cheaper costs
Misc
- There is currently my aws-cdk PR open for importing the Typescript Lambda@Edge interface https://github.com/aws/aws-cdk/pull/18836
Thanks To
- Crespo Wang for his pioneer work regarding private S3 assets https://javascript.plainenglish.io/use-lambda-edge-jwt-to-secure-s3-bucket-dcca6eec4d7e
- As always to the amazing CDK / Projen Community. Join us on Slack!
- Projen project and the community around it
- To you for checking this out. Check me out and perhaps give me feedback https://martinmueller.dev
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Close
Hashes for cdk-private-asset-bucket-1.143.6.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | c8e7dad823947469c42a9917aaeb760578e6bc5b9b86b5295f19a237d34f5acc |
|
MD5 | 8ffd38f9dbb52739e093ec23341bcec5 |
|
BLAKE2b-256 | 2cad5a4beacd99b67be56dbf9e4a11ac788beddd50ccbc58cf5e2ad4e0aaaa19 |
Close
Hashes for cdk_private_asset_bucket-1.143.6-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 4bec36ec5fd22b28f0a941cb5678b3e2048c98f7d1f629943a0dafeee863406e |
|
MD5 | 3592d975bd8e42203a2adb0c7b446624 |
|
BLAKE2b-256 | e0d7a34e58937d380c60b3aca63f58ac1cbb08b49d631ed4815b7c0a5dc13925 |