Send SMS from Using Amazon SNS Services

Question

I am working on integrating Pega with AWS services, and I need help configuring IAM roles with AWS Security Token Service (STS). Below are the specific requirements and challenges we're facing:
*Set up an IAM role with the necessary permissions for SNS (Simple Notification Service).
**Configure trust relationships to allow Pega's service or application to assume the IAM role.
*Use temporary credentials generated by AWS STS when the role is assumed, instead of relying on static keys.

I want to configure the AWS SDK or custom code to assume the IAM role during runtime. This will enable Pega to call AWS services using temporary credentials generated by AWS STS.

**We attempted to use the AWS SDKs but encountered the following error:**
*com.amazonaws.SdkClientException: Unable to load AWS credentials from any provider in the chain: 
[EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY)), 
SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey), 
WebIdentityTokenCredentialsProvider: You must specify a value for roleArn and roleSessionName, 
com.amazonaws.auth.profile.ProfileCredentialsProvider@6d6a7249: profile file cannot be null, 
com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@4d3e18e5: The requested metadata is not found at http://169.254.169.254/latest/meta-data/iam/security-credentials/]*

Are there any exposed APIs or alternative solutions to help achieve this integration in a simpler way? Any suggestions on how to resolve the above issue or recommendations for smoother integration would be greatly appreciated.

Thanks in advance for your support.

Best regards,
Roshan Raj A K

re:Post Agent · Answer

To integrate Pega with AWS services for sending SMS using Amazon SNS, while utilizing IAM roles and AWS Security Token Service (STS), you'll need to follow these steps:

1. Set up an IAM role for SNS:
   Create an IAM role with the necessary permissions for Amazon SNS. Attach a policy that grants access to publish SMS messages through SNS.

2. Configure trust relationships:
   Modify the trust policy of the IAM role to allow Pega's service or application to assume the role. You'll need to specify the principal (e.g., EC2 instance, Lambda function, or external account) that represents your Pega application.

3. Use temporary credentials:
   Instead of using static access keys, configure your application to assume the IAM role and obtain temporary credentials from AWS STS.

To resolve the error you're encountering, consider the following:

1. Ensure that your Pega application has the necessary permissions to assume the IAM role.

2. If running on an EC2 instance, make sure the instance has an IAM role attached with the required permissions.

3. If not running on AWS infrastructure, you may need to provide a method for obtaining initial credentials to assume the role.

4. Use the appropriate AWS SDK method to assume the role and obtain temporary credentials. For example, in Java, you can use the STSAssumeRoleSessionCredentialsProvider class.

5. Configure the AWS SDK to use the obtained temporary credentials when making calls to SNS.

Here's a general approach to implement this in your code:

1. Create an AWSSecurityTokenService client.
2. Use the client to assume the IAM role, specifying the role ARN and a session name.
3. Use the temporary credentials returned by the assume role operation to create an AmazonSNS client.
4. Use the AmazonSNS client to send SMS messages.

Remember to handle credential rotation by periodically refreshing the temporary credentials before they expire.

By following these steps and properly configuring your application to assume the IAM role, you should be able to securely integrate Pega with AWS SNS for sending SMS messages using temporary credentials.  
**Sources**  
[SmsConfigurationType.Builder (AWS SDK for Java - 2.21.28)](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/cognitoidentityprovider/model/SmsConfigurationType.Builder.html)  
[SmsMfaConfigType.Builder (AWS SDK for Java - 2.21.29)](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/cognitoidentityprovider/model/SmsMfaConfigType.Builder.html)  
[IAM policies for Amazon SNS topics - AWS End User Messaging SMS](https://docs.aws.amazon.com/sms-voice/latest/userguide/two-way-sms-iam-policy.html)  
[Amazon SNS security best practices - Amazon Simple Notification Service](https://docs.aws.amazon.com/sns/latest/dg/sns-security-best-practices.html)

Send SMS from Using Amazon SNS Services

Add your answer

Relevant content