Clojurians Log v2

I created two stages in API Gateway. One called "dev" and one called "prod". I am satisfied with how dev is and would like to roll that into prod which seems to me like a very simple/common task but I can't seem to figure out how to do that. 1. Is that possible? 2. Is it best practice?

That should just be a matter of deploying the api to the prod stage.

Are you using the console for this or something else?

The console @dmarjenburgh. I think I understand the flow now though =]

I have a javascript front end which I want to enable to authenticate through Cognito when it hits an endpoint in API Gateway. Should I hard code user credentials into my js in order to get a token and hit our resources? Or is there a different solution for doing server to server authentication? I've looked into server to server authentication but I'm not able to find much on it. If someone had an idea of what is best-practice for this situation I'd really appreciate it!

@brian.rogers Look at aws-amplify. Never hard code your credentials.

@lanejo01 This doesn't look a whole lot different to me. I might be missing something but all their examples have to to with users using usernames and passwords. I can't quite see how I might use Amplify to give my js front end access to my back end resources without hard coding a username and password. The use case here is that we want to pull data from our database before a user signs in. So at the point we don't yet have any creds. I was hoping for a way of authenticating with Cognito without a user providing credentials

Should said data in the database be considered safe for public display?

whatever your frontend exposes to the enduser should be considered public information

no point of putting usernames or passwords there, might just as well drop the auth from the server

I suppose it could be... But there has to be a way to do server-server authentication right? Removing the fact that this is .js and front end from the conversation, if I know a server will always be in our hands and I want that server to pull data from our server in AWS, how should I go about doing that authentication?

when you're talking server to server stuff and all your stuff is inside of aws - use instance profile & the credentials that are provided by that, everything else ends up being a worse idea

What if my other server I not running in AWS? Would it not make sense to do that?

well then you're either going to have shared credentials or a public-private key pair / certificate stuff (and the latter is definitely the better option, but only if you know what you are doing)

which ever you choose - make sure they have a different path of getting to your server than your code does

so you can't accidentally commit them into your repo and miss out on it

europe says it's late, time to sleep 🙂 read up on how rsa based jwt or ssl client cert auth works (i guess the latter is still not support on api gw). for a good solution i'd say these are the way to go to secure your things without going custom custom

I've never been able to find a means of authentication with Cognito using keys or certs. Is it called something special? Just a man page or something would be really helpful

that being said - i'm working my way towards removing the apigw and web app lambdas from my architecture - just not worth the extra hustle

you were talking server to server stuff 🙂 ... but by all the looks cognito is just something oauth-isch for enduser authentications

i'm off to sleep, i guess you have to read more to navigate around in the space 🙂

Thanks for your help!!

Brian: What's wrong with keys for this situation?

I feel like I missed something here

Server to server you def auth via cognito

I just haven't been able to find a single page anywhere that talks about actually doing key based authentication with Cognito. I have apigw endpoint I want to hit and it currently has an authorizer attached to a user pool. And I want a server that is 100% mine to be able to use that endpoint

https://docs.aws.amazon.com/en_pv/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html https://lobster1234.github.io/2018/05/31/server-to-server-auth-with-amazon-cognito/

What you're trying to do isn't that uncommon. The Manish Pandit article looks a lot alike what we've done a few times.

https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/s3-example-photo-album.html is a good example of using Identity Pools for that @brian.rogers.

The Identity Pool has an IAM role for authenticated users, which allows access to other resources (in that example putting to an S3 bucket). Can authenticate a user with a user pool (or another identity provider) and then use the identity pool for authentication.

@mj_langford I'd tried using the lobster server-to-server tutorial but I got errors halfway through the I wasn't sure how to solve. If you are familiar with that tutorial, might you take a look at the error I am getting?

Here they are talking directly to S3. I was hoping to use a web request with API Gateway. Would this still make sense here? It doesn't seem like it would

I have done this a couple times, happy to look at your error

Firstly lets look at my request to make sure that's ok:

curl -X POST \
          https://&lt;my-domain&gt;.<http://auth.us-east-2.amazoncognito.com/oauth2/token|auth.us-east-2.amazoncognito.com/oauth2/token> \
          -H 'authorization: Basic &lt;4 character base64'd version of "&lt;id&gt;:&lt;secret-id&gt;"' \
          -H 'content-type: application/x-www-form-urlencoded' \
          -d 'grant_type=client_credentials&amp;scope=transactions%2Fpost'

There could be some misconfigured Cognito stuff if that command looks okay

invalid client = that client doesn't match.

I believe you're not getting a real authorization hash from your client id and secret

How long are your x and y in that?