update cognito

apigw/get-s3-files/README.md

@@ -0,0 +1,8 @@
+# Get S3 files from API Gateway
+
+## Get Bearer Token (ID Token)
+
+aws cognito-idp initiate-auth \
+ --auth-flow USER_PASSWORD_AUTH \
+ --client-id <client-id> \
+ --auth-parameters USERNAME=[email protected],PASSWORD=TempPassword123!

apigw/get-s3-files/apigw.tf

@@ -1,66 +1,92 @@
-resource "aws_api_gateway_rest_api" "hello_world" {
-  name        = "basic-invoke-lambda-function"
+resource "aws_api_gateway_rest_api" "handle_s3_obj" {
+  name        = "get-upload-s3-object"
   description = "API Gateway for Hello World Lambda"
 
 }
 
-
-resource "aws_api_gateway_resource" "hello_world" {
-  rest_api_id = aws_api_gateway_rest_api.hello_world.id
-  parent_id   = aws_api_gateway_rest_api.hello_world.root_resource_id
-  path_part   = "hello-world"
-
+resource "aws_api_gateway_resource" "s3_object" {
+  rest_api_id = aws_api_gateway_rest_api.handle_s3_obj.id
+  parent_id   = aws_api_gateway_rest_api.handle_s3_obj.root_resource_id
+  path_part   = "s3-object"
 }
 
 
-resource "aws_api_gateway_method" "hello_world_method" {
-  rest_api_id   = aws_api_gateway_rest_api.hello_world.id
-  resource_id   = aws_api_gateway_resource.hello_world.id
+resource "aws_api_gateway_method" "get_method" {
+  rest_api_id   = aws_api_gateway_rest_api.handle_s3_obj.id
+  resource_id   = aws_api_gateway_resource.s3_object.id
   http_method   = "GET"
-  authorization = "NONE"
-
+  authorization = "COGNITO_USER_POOLS"
+  authorizer_id = aws_api_gateway_authorizer.cognito_auth.id
 }
 
+resource "aws_api_gateway_method" "upload_method" {
+  rest_api_id   = aws_api_gateway_rest_api.handle_s3_obj.id
+  resource_id   = aws_api_gateway_resource.s3_object.id
+  http_method   = "POST"
+  authorization = "COGNITO_USER_POOLS"
+  authorizer_id = aws_api_gateway_authorizer.cognito_auth.id
+}
 
 resource "aws_api_gateway_method_settings" "default" {
-  rest_api_id = aws_api_gateway_rest_api.hello_world.id
+  rest_api_id = aws_api_gateway_rest_api.handle_s3_obj.id
   stage_name  = aws_api_gateway_stage.production.stage_name
   method_path = "*/*"
 
   settings {
     metrics_enabled = true
     logging_level   = "INFO"
-
   }
+  depends_on = [ aws_api_gateway_account.api_gw_account ]
 }
 
 
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = aws_api_gateway_rest_api.hello_world.id
-  resource_id = aws_api_gateway_resource.hello_world.id
-  http_method = aws_api_gateway_method.hello_world_method.http_method
+resource "aws_api_gateway_integration" "get_lambda_integration" {
+  rest_api_id = aws_api_gateway_rest_api.handle_s3_obj.id
+  resource_id = aws_api_gateway_resource.s3_object.id
+  http_method = aws_api_gateway_method.get_method.http_method
 
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
   uri                     = aws_lambda_function.hello_world.invoke_arn
 }
 
+resource "aws_api_gateway_integration" "upload_lambda_integration" {
+  rest_api_id = aws_api_gateway_rest_api.handle_s3_obj.id
+  resource_id = aws_api_gateway_resource.s3_object.id
+  http_method = aws_api_gateway_method.upload_method.http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.hello_world.invoke_arn
+}
+
+
 resource "aws_api_gateway_stage" "production" {
-  deployment_id = aws_api_gateway_deployment.hello_world_deployment.id
-  rest_api_id   = aws_api_gateway_rest_api.hello_world.id
+  deployment_id = aws_api_gateway_deployment.production_deployment.id
+  rest_api_id   = aws_api_gateway_rest_api.handle_s3_obj.id
   stage_name    = "production"
 }
 
 resource "aws_api_gateway_account" "api_gw_account" {
-  cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch_role.arn
+  cloudwatch_role_arn = aws_iam_role.lambda_execution_role.arn
 }
 
 
-resource "aws_api_gateway_deployment" "hello_world_deployment" {
-  rest_api_id = aws_api_gateway_rest_api.hello_world.id
+resource "aws_api_gateway_deployment" "production_deployment" {
+  rest_api_id = aws_api_gateway_rest_api.handle_s3_obj.id
 
   depends_on = [
-    aws_api_gateway_method.hello_world_method,
-    aws_api_gateway_integration.lambda_integration
+    aws_api_gateway_method.get_method,
+    aws_api_gateway_integration.get_lambda_integration,
+    aws_api_gateway_integration.upload_lambda_integration,
+    aws_api_gateway_method.upload_method
   ]
 }
+
+
+resource "aws_api_gateway_authorizer" "cognito_auth" {
+  name          = "CognitoAuthorizer"
+  rest_api_id   = aws_api_gateway_rest_api.handle_s3_obj.id
+  type          = "COGNITO_USER_POOLS"
+  provider_arns = [aws_cognito_user_pool.apigw_user_pool.arn]
+}

apigw/get-s3-files/cognito.tf

@@ -0,0 +1,42 @@
+resource "aws_cognito_user_pool" "apigw_user_pool" {
+  name = "apigw_user_pool"
+
+  password_policy {
+    minimum_length    = 8
+    require_lowercase = true
+    require_numbers   = true
+  }
+
+  username_attributes = ["email"]
+}
+
+
+resource "aws_cognito_user_pool_client" "user_pool_client" {
+  name         = "apigw_client"
+  user_pool_id = aws_cognito_user_pool.apigw_user_pool.id
+
+  explicit_auth_flows = [
+    "ALLOW_USER_PASSWORD_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+  ]
+
+  generate_secret = false
+}
+
+resource "aws_cognito_user" "test_user" {
+  user_pool_id = aws_cognito_user_pool.apigw_user_pool.id
+  username     = "[email protected]"
+  attributes = {
+    email = "[email protected]"
+  }
+
+  password = "TempPassword123!"
+  force_alias_creation = false
+  message_action = "SUPPRESS"
+}
+
+resource "aws_cognito_user_pool_domain" "main" {
+  domain       = "${data.aws_caller_identity.current.account_id}-apigw"
+  user_pool_id = aws_cognito_user_pool.apigw_user_pool.id
+}

apigw/get-s3-files/data.tf

@@ -2,4 +2,7 @@ data "archive_file" "lambda" {
   type        = "zip"
   source_dir  = "${path.module}/lambda/"
   output_path = "${path.module}/lambda.zip"
+}
+data "aws_caller_identity" "current" {
+
 }

apigw/get-s3-files/lambda.tf

@@ -8,7 +8,11 @@ resource "aws_iam_policy" "lambda_s3_access_policy" {
         Action = [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
-          "logs:PutLogEvents"
+          "logs:DescribeLogGroups",
+          "logs:DescribeLogStreams",
+          "logs:PutLogEvents",
+          "logs:GetLogEvents",
+          "logs:FilterLogEvents",
         ]
         Effect   = "Allow"
         Resource = "arn:aws:logs:*:*:*"
@@ -39,5 +43,5 @@ resource "aws_lambda_permission" "api_gw_permission" {
   function_name = aws_lambda_function.hello_world.function_name
   principal     = "apigateway.amazonaws.com"
 
-  source_arn = "${aws_api_gateway_rest_api.hello_world.execution_arn}/*/*"
+  source_arn = "${aws_api_gateway_rest_api.handle_s3_obj.execution_arn}/*/*"
 }

apigw/get-s3-files/lambda/main.py

@@ -1,5 +1,6 @@
 import json
 def lambda_handler(event, context):
+    print(event)
     message = {
         'message': 'Hello World'
     }

apigw/get-s3-files/main.tf

@@ -8,7 +8,10 @@ resource "aws_iam_role" "lambda_execution_role" {
         Action = "sts:AssumeRole"
         Effect = "Allow"
         Principal = {
-          Service = "lambda.amazonaws.com"
+          Service = [
+          "lambda.amazonaws.com",            
+          "apigateway.amazonaws.com"
+          ]
         }
       },
     ]

apigw/get-s3-files/output.tf

@@ -0,0 +1,19 @@
+output "api_upload_object" {
+  value = aws_api_gateway_stage.production.invoke_url
+}
+
+output "app_client_id" {
+  value = aws_cognito_user_pool_client.user_pool_client.id
+}
+
+output "domain_pool_id" {
+  value = aws_cognito_user_pool_domain.main.id
+}
+
+output "auth_url" {
+  value =  "https://${aws_cognito_user_pool_domain.main.id}.auth.us-east-1.amazoncognito.com/oauth2/authorize"
+}
+
+output "access_token_url" {
+    value =  "https://${aws_cognito_user_pool_domain.main.id}.auth.us-east-1.amazoncognito.com/oauth2/token"
+}