Serverless-stack-com: Separating Cognito UnAuth from Auth - Not requiring user to be logged in to submit data

[hollygirouard]

Hi there @jayair!

First of all - THANK YOU! This documentation has saved my life. I've been able to implement this into my own requirements with a very short deadline which is pretty great.

This is somewhat of an urgent issue and digging through the Amazon documentation has my eyes crossed.

I was wondering if you had any words of wisdom.

So I have a front end and a backend. I'm having trouble not requiring the user to be logged in to submit data.

On the frontend I have a form where anyone can submit data.

On the backend I have an admin page where an admin can login and view all of the data, download it, whateves.

My question, is how do I need to make it possible for the front end user to not be required to login? I'm trying not to biff my current permissions. Most of my code modified/developed from your current curriculum so it seems like it's something you would know.

Any advice you have is SUPER helpful.

Thanks in advance!

[jayair]

@hollyewhite I added a pretty short comment on this idea here - https://github.com/AnomalyInnovations/serverless-stack-com/issues/52#issuecomment-343689561

It's pretty straightforward to do. But let me know if you need any additional detail.

[hollygirouard]

@jayair Thank you! I really like that idea but would love if you could elaborate a little bit more. Since I'm so far down this road, I'm a little nervous about breaking what I have in order to implement this.

Out of curiosity - If you offer consulting time, I'd be happy to pay to better understand or donate to the project (whatever you prefer). Happy to contribute as well! It's an important client and I'd rather understand it further in order to get it right the first time! :)

Thanks in advance! You rock!

[jayair]

@hollyewhite Thanks, yeah any donations would be greatly appreciated. You can send me an email @ jay at anoma.ly and I can take a look a better look.

[hollygirouard]

Hey Jay!

I just replied from holly elizabeth white at gmail com. Let me know if you
got it and if that works for you. :)

Thank you!!!

On Wed, Nov 15, 2017 at 5:51 PM, Jay V [e-mail] wrote:

@hollyewhite https://github.com/hollyewhite Thanks, yeah any donations
would be greatly appreciated. You can send me an email @ jay at anoma.ly
and I can take a look a better look.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/AnomalyInnovations/serverless-stack-com/issues/163#issuecomment-344779258,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AToRJEgTGWYHAsOjkKphGwNP5iXSX3Fqks5s24ckgaJpZM4QfY1X
.

[jayair]

@hollyewhite I'll address the question you guys had about how to do public S3 uploads with a comment here. So it'll help if anybody else comes across it. And I'll probably turn this in to a chapter at some point.

1. Your Identity Pool needs to enable access to unauthenticated identities.
   

2. The Unauth Role for the identity pool needs access to the S3 bucket you are uploading to.
   

3. Your s3Upload method for public uploads looks very similar to the one in the tutorial.

export async function s3Upload(file) {
  await getAwsCredentials();

  const s3 = new AWS.S3({
    params: {
      Bucket: config.s3.BUCKET
    }
  });
  const filename = file.name;

  return s3
    .upload({
      Key: filename,
      Body: file,
      ContentType: file.type,
      ACL: "public-read"
    })
    .promise();
}

1. Here getAwsCredentials is also similar to the one in the tutorial. Except we don't have an authenticator.

function getAwsCredentials() {
  AWS.config.update({ region: config.cognito.REGION });

  AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: config.cognito.IDENTITY_POOL_ID,
    Logins: { }
  });

  return AWS.config.credentials.getPromise();
}

Hopefully that makes sense.