By using AWS re:Post, you agree to the Terms of Use

Questions tagged with AWS Identity and Access Management

Sort by most recent
  • 1
  • 12 / page

Browse through the questions and answers listed below or filter and sort to narrow down your results.

Does the AWS SDK for JavaScript V3 handle refresh of expired temporary credentials?

I am developing an application using Amazon Cognito User Pools and Identity Pools. My application uses: * the Cognito Hosted UI and authorization code grant to get an authorization code * a POST request to a standard `oauth2/token` endpoint to exchange the authorization code for an `id_token`, `access_token`, and `refresh_token` * the AWS SDK for JavaScript V3 `fromCognitoIdentityPool` method to exchange an `id_token` for temporary AWS credentials (which are used to allow users to access various AWS services) My question relates to the expiration and refresh of these temporary AWS credentials. The IAM user guide says [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html): > You must make sure that you get a new set of credentials before the old ones expire. In some SDKs, you can use a provider that manages the process of refreshing credentials for you; check the documentation for the SDK you're using. I am using the AWS SDK for JavaScript V3. I have searched through these resources without finding any reference to whether or not the SDK handles refreshing of temporary credentials: 1. [The API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/index.html) 2. [The Developer Guide](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/welcome.html) 3. [Various code files from the repository](https://github.com/aws/aws-sdk-js-v3) I did find one tangential, ambiguous reference to credential expiration and refreshing on the page ["Using Amazon Cognito Identity to authenticate users"](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/loading-browser-credentials-cognito.html) in the section named ***Switch to Authenticated User***. I think adding a section to this page about the details of temporary credentials refresh would be extremely helpful to developers. **Does the AWS SDK for JavaScript V3 handle refresh of expired temporary credentials? Where is this described in the documentation for the SDK?** If yes: * Does the SDK handle the exchange of a `refresh_token` for an `id_token` and then exchange of an `id_token` for expired temporary credentials? * Or does the SDK require developers to write application code that exchanges a `refresh_token` for an `id_token`? (Meaning the SDK would just handle exchanging an `id_token` for expired temporary credentials)
0
answers
0
votes
6
views
profile picture
asked 9 hours ago
1
answers
0
votes
46
views
asked 11 hours ago

Restriction on CloudFormation StackSet with IAM condition cloudformation:TemplateUrl

I'm trying to restrict the S3 bucket used for **StackSet** templates with the IAM condition **cloudformation:TemplateUrl**, but it's does not work as expected: the IAM Policy applied always deny the CreateStackSet. See below the tested policy. The [doc page](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions) explains that you can use the condition as usual, but there is a Note that is not clear for me: ![Enter image description here](/media/postImages/original/IMUjPviuTuSAaoxl5HvXktBQ) For allowed CreateStackSet calls, the CloudTrail event included the TemplateUrl in the context, so I don't understand why the condition does not work with Stack Set. Thank for your help! ``` { "eventVersion": "1.08", [...] "eventTime": "2022-08-09T15:42:50Z", "eventSource": "cloudformation.amazonaws.com", "eventName": "CreateStackSet", "awsRegion": "us-east-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": { "stackSetName": "test-deny1", "templateURL": "https://s3.amazonaws.com/trusted-bucket/EnableAWSCloudtrail.yml", "description": "Enable AWS CloudTrail. This template creates a CloudTrail trail, an Amazon S3 bucket where logs are published, and an Amazon SNS topic where notifications are sent.", "clientRequestToken": "1bd60a6d-f9dc-76a9-020a-f5a45f1bdf1e", "capabilities": [ "CAPABILITY_IAM" ] }, "responseElements": { "stackSetId": "test-deny1:97054f39-3925-47eb-92fd-09779f32bcf6" }, [...] } ``` For reference my IAM Policy: ``` { "Sid": "TemplateFromTrustedBucket", "Effect": "Allow", "Action": [ "cloudformation:CreateStackSet", "cloudformation:UpdateStackSet" ], "Resource": "*", "Condition": { "StringLike": { "cloudformation:TemplateURL": [ "https://s3.amazonaws.com/trusted-bucket/*" ] } } } ```
0
answers
0
votes
14
views
profile picture
asked a day ago

S3 Access Denied 403 error

Hi AWS, I was learning about App2Container service using this AWS Workshop https://catalog.us-east-1.prod.workshops.aws/workshops/2c1e5f50-0ebe-4c02-a957-8a71ba1e8c89/en-US and while deploying the infrastructure using CloudFormation template as provided in Step 1, I am experiencing the issue. ``` Resource handler returned message: "Your access has been denied by S3, please make sure your request credentials have permission to GetObject for application-migration-with-aws-workshop/lambda/4eb5dfa8efc17763bc41edb070cb9cd2. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: Lambda, Status Code: 403, Request ID: 95687072-37e7-4670-b715-7a0e5bdefd92)" (RequestToken: 09b159a9-c86b-72ef-5d6e-c18bbed29004, HandlerErrorCode: AccessDenied) ``` After that I have updated the IAM user permission with the following S3 API and here is the code for the same: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::application-migration-with-aws-workshop", "arn:aws:s3:::application-migration-with-aws-workshop/lambda/4eb5dfa8efc17763bc41edb070cb9cd2", "arn:aws:s3:::application-migration-with-aws-workshop/lambda/438e5a43749a18ff0f4c7a7d0363e695" ] } ] } ``` Please tell me what's the reason behind the failure. I know this is Amazon owned bucket. So what's missing either from permissions point of view. Thanks
2
answers
0
votes
46
views
profile picture
asked 7 days ago
  • 1
  • 12 / page