Serverless-stack-com: Comments: Create a Cognito Identity Pool

[jayair]

Link to chapter - http://serverless-stack.com/chapters/create-a-cognito-identity-pool.html

[copperspeed]

Hi - Can we add multiple resources here if we multiple api's?

"Resource": [
  "arn:aws:execute-api:YOUR_API_GATEWAY_REGION:*:YOUR_API_GATEWAY_ID/*",
  "arn:aws:execute-api:YOUR_API_GATEWAY_REGION:*:YOUR_API_GATEWAY_ID/*"
] 

[jayair]

@copperspeed Yeah you can!

[bbskuo]

Hi - I see documentation for the authenticated user policy but not for the unauthenticated user. Is there a specific setup for that? Thanks!

[jayair]

@bbskuo For this tutorial, the app and it's resources are behind a login. That's why we only show the authenticated user policy here.

[mictian]

Hi,
First of all, very nice tutorial, thank you very much!
There is a small point that I dont get it yet (more AWS related that serverless perhaps - sorry for this)
Under which role are the lambdas executed?

I mean, you have defined an IAM role in the serverless.yml, and now a new set of permissions for authenticated users. Is it needed both roles/permissions? Why?

Thank you in advance,
Mictian

[jayair]

@mictian Yeah it's pretty confusing.

The IAM portion in the serverless.yml is what the Lambdas have access to. This is different from what a user on the outside can access. The roles for authenticated users in the Identity Pool is telling AWS which services a user can invoke. So a user invokes API Gateway which in turn invokes Lambda. But the Lambda has it's own set of permissions that are defined in the serverless.yml.

Hopefully that makes some sense.

[JackEdwardLyons]

Hi, where do I find my API_GATEWAY_ID ?
Do you mean App Client ID?

When I deployed my API in the last chapter, all I got back was this response:

Serverless: Stack update finished... Service Information service: notes-app-api stage: prod region: us-east-2 stack: notes-app-api-prod api keys: None endpoints: POST - https://akse8rq9w0.execute-api.us-east-2.amazonaws.com/prod/notes GET - https://akse8rq9w0.execute-api.us-east-2.amazonaws.com/prod/notes/{id} GET - https://akse8rq9w0.execute-api.us-east-2.amazonaws.com/prod/notes PUT - https://akse8rq9w0.execute-api.us-east-2.amazonaws.com/prod/notes/{id} DELETE - https://akse8rq9w0.execute-api.us-east-2.amazonaws.com/prod/notes/{id} functions: create: notes-app-api-prod-create get: notes-app-api-prod-get list: notes-app-api-prod-list update: notes-app-api-prod-update delete: notes-app-api-prod-delete

[mictian]

Hi @jayair,
Sorry for the delay. Thank you for your answer, that makes all the sense.
So no impersonation at all, got it, perfect :smile: !

[jayair]

@JackEdwardLyons The format looks like this:

https://API_GATEWAY_ID.execute-api.REGION.amazonaws.com/STAGE/PATH

So yours would be, akse8rq9w0.

I'll add a note to the chapter to make it more clear.

[mjbf0748]

@jayair HTTP401: DENIED - The requested resource requires user authentication. I am getting this error in the console, does this strictly have to do with the cognito identity chapter. Do you have any suggestions?

[jayair]

@mjbf0748 When are you seeing this error?

[mjbf0748]

@jayair When I make a 'get' call while the app is running. I am getting this error in the console. This is a call to the second dynamodb table I added in the get.js file.

[jayair]

@mjbf0748 The error sounds like the user is not authenticated. Are you logged in?

[mjbf0748]

Yes. I am logged in with the test user created in the early chapters.

On Sat, Mar 31, 2018 at 4:43 PM Jay V [e-mail] wrote:

@mjbf0748 https://github.com/mjbf0748 The error sounds like the user is
not authenticated. Are you logged in?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/AnomalyInnovations/serverless-stack-com/issues/19#issuecomment-377722146,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AX2oR2G_DiNtbXQqKQ8fMdl0zHtPDg8Mks5tj-p4gaJpZM4M4OBA
.

[jayair]

@mjbf0748 So is this happening in the browser? Can I see a screenshot of the error?

[mjbf0748]

@jayair

[jayair]

@mjbf0748 It seems like you are not using any authentication? Do you have this line set in your App.js - https://github.com/AnomalyInnovations/serverless-stack-demo-client/blob/master/src/index.js#L12? And are you making requests using Amplify?

[mjbf0748]

@jayair I had not used Amplify since I had started with the previous version of the tutorial. Should I begin by implementing it?

[jayair]

@mjbf0748 It depends how far along you are. If you are almost done, I'd say complete it and then go over the update. Most of the structure is the same with Amplify. It just makes some parts simpler.

[mjbf0748]

I have completed most of it. I want to fix this authentication issue before
I continue. If Amplify may help fix this error, I will go over the update.
What do you think?

On Wed, Apr 4, 2018 at 3:36 PM Jay V [e-mail] wrote:

@mjbf0748 https://github.com/mjbf0748 It depends how far along you are.
If you are almost done, I'd say complete it and then go over the update.
Most of the structure is the same with Amplify. It just makes some parts
simpler.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/AnomalyInnovations/serverless-stack-com/issues/19#issuecomment-378719846,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AX2oR3cnzpTKPOtBIT28M2qR1KOT9Nhkks5tlSDTgaJpZM4M4OBA
.

[jayair]

@mjbf0748 The Amplify update does authentication slightly differently. So it might be worth trying it.

[19bharatvikram]

Hi Jay,

I have 2 users and as per our application design, they can see their notes only. But now, I want enable user1 to view/edit the notes of user2 but not delete them.

Is it possible to do that ? if yes How?

Thanks,
Bharat Chand

[jayair]

@19bharatvikram There are lots of ways to do this. Currently, we get notes using a user id and note id pair. To allow users to access other user's notes; you'd need to store your notes under a different index. Maybe just store it under note id. But you'll need to separately track which user has access to which set of notes.

[19bharatvikram]

Hi Jay,

Thanks for your quick response. I understand that I'll need an index column say noteId for that. Just wanted to know more how can I make a track of which users has access to which set of notes. Any pseudo code or sample IAM role/policy or any reference link/doc will help.

Thanks again,
Bharat Chand

[jayair]

@19bharatvikram Hmmm you could use an IAM role if your user groups are not dynamic. Say for example you had an admin group and regular users group that had different set of permissions. Then you could create roles for them. But if the relationships are dynamic then it might be trickier.

[jayair]

This issue was moved to https://discourse.serverless-stack.com/t/comments-create-a-cognito-identity-pool/135