I'm starting with AWS. I want to create a flat-file website hosted in S3 with a restricted area protected by a password. I'm doing user authentication with Amazon Cognito.
For the restriction of unlogged users there is a problem, I can't just serve flat files and check for the JWT token with javascript, because the user can easily disable javascript or mess with it and still read the file.
How to protect/restrict access in this case? Does Amazon S3 provide any restriction or redirection of access for unlogged cognito users?
If you are using AWS Cognito Federated identities, you can define two distinguish IAM roles to assume for authenticated users and unauthenticated users.
In each of these role policies, you can define which part of S3 is allowed to access and the actions you can perform.
Note: If you are currently using Cognito Userpools, you can connect it with Cognito Federated Identities to implement this feature.
Related
As an admin, I wanted my AWS users not to enable unauthenticated user identity in AWS Cognito. Is there any way to restrict this action? Can this be achieved through service control policy?
Basically I don't want my AWS users to enable AWS resource access to any guest users.
I don't think you can do anything but prevent them from creating Cognito resources entirely.
There is nothing in the Cognito SAR pages that indicates that you can differentiate on authenticated/unauthenticated identities.
Let's say I want to store some files for each user which is using my website on s3. Later I want authenticate each request to s3 to make sure that user has access to the files she is requesting. I guess this can't be done using presigned URLs or signed cookies(using cloud front). So which Amazon service should I use for that? What is the simplest way to achieve this?
Lets saying I'm authenticating users using jwt and its possible to recognize wheather a user has access to a file or not by the filename and content of the jwt.
I'm sorry that I don't have enough reputation to comment so I'll post an answer here.
One solution is:
AWS Cognito (Federated Identities)
S3 (one bucket)
S3 bucket policies allow you to restrict access to "user folders" equivalent here to "identity" by the prefix like yourbucket/<cognito_identity_id>/* Each user on your webpage will have its own federated identity.
When you create and configure the identity pool in AWS define a custom authentication provider and authenticate users "by the developer" in your backend.
Also, associate the authenticated identities to one IAM Role with access to the S3 bucket where you will keep the data. The bucket policy will take care of only allowing each user to their files and not to others. (See referenced links for policy example and more)
Amazon S3: Allows Amazon Cognito Users to Access Objects in Their Bucket
Access to User level folders using Amazon S3 and Cognito
Developer Authenticated Identities (Identity Pools)
I'm a newbie to AWS, I'm building an application where the users should be logged in via AWS account.
So I created a user pool and authenticated via AWS SDK using the federated identities. But the users were created manually in the Cognito UI.But the requirement is to authenticate the user if they already resides in AWS as an IAM user. But AWS cognito does not provide a workflow to import the IAM users to cognito pool. So is there another way to accomplish this via AWS ? Thanks in Advance.
This is currently not possible. Although AWS Cognito Federated Identities allows, federating an external identity provider to grant AWS access, the other way around is not possible.
In addition, there is no method in AWS IAM SDK to verify AWS Username and Password, which also limits verifying them through your own implementation.
I have an embedded device that requires the ability to write to S3. I want to avoid giving the embedded device an actual AWS IAMUser. I am looking at using Cognito to gain write access to S3.
I have a user pool with a group and one user (for now). The group has an attached policy which permits access to write to a certain S3 bucket. The pool is setup so that only admins can create new users. I have managed to authenticate the cognito user and have got access to refresh tokens and the idTokens. I am looking to use these tokens to write to my s3 bucket.
I am trying to follow trying to follow the documentation but am getting confused. I think i need a federated identity pool but i have no requirement for a public provider. I just want my cognito user group to write to s3.
Is there a simple solution to allow a cognito user to write to S3 without federated identities or if not do i require a back end to serve a token for a federated identity?
I have been using warrant https://github.com/capless/warrant to authenticate as so:
from warrant.aws_srp import AWSSRP
import boto3
client = boto3.client('cognito-idp')
aws = AWSSRP(username='<username>', password='<password>', pool_id='<pool>',
client_id='<clientid>', client=client)
tokens = aws.authenticate_user()
Any tips would be greatly appreciated!
You do need a federated identity pool. In the identity provider section you choose Cognito and enter your pool ID and pool client ID. Then, you need to provide the identity pool with authenticated and unauthenticated roles. You can use these roles to provide that S3 write access.
This is the default behavior for the identity provider setup. If you want the Role to come from the group that your user is in, you will need to set the Choose role from token option in the identity provider section under where you provided your pool and client id.
I am developing a web application with two mobile(Android & iOs) based applications of the same. Currently the files uploaded are open to all, which in terms means that anyone with the direct image link can open it using a web browser.
How can I protect or limit the file access to the users of my mobile applications or web application ?
NB: As a beginner, I am not sure about the configuration details to be provided along with question, If I need to give more details on my s3 config. please specify it, I can add it to the s question to make the question more meaningful, so sorry for the inconvenience.
I think an easier approach than pre-signed urls would be to use Amazon Cognito to provide access to AWS resources to your trusted applications, even to unauthenticated users.
To do this you would create an Identity Pool for your application (just need one pool for all 3 of your clients) and then configure it so that when a client provides a valid Identity Pool Id they can assume an IAM role with permissions to access AWS resources.
Then you control what S3 bucket permissions the IAM role they assume would have - you could allow unauthenticated users access to read the S3 objects, or force them to create accounts to be able to read/write to S3 buckets (this is very easy with Cognito - users can sign up with facebook, gmail, their own email, etc.)
There's a step-by-step guide here for setting up an identity pool with Cognito, and then allowing unauthenticated users to assume an IAM role that can access the contents of an S3 bucket
The above causes the same set of permissions for all guest user accounts - that have assumed an IAM role through Amazon Cognito by identifying themselves as part of an identity pool.
edit: I should point out that if you authenticate via Cognito, you'll need to access the S3 bucket through the S3 Transfer Manager from the AWS SDK