search

aws-samples / amazon-gamelift-ultrafrogroyale-large-match-sample

A small sample game that demonstrates how to use GameLift FlexMatch new large match features.
Apache License 2.0
22 stars 12 forks source link

Sample uses authors Cognito unauth role without cross-account access to invoke a Lambda in the customer's account #2

Open alanmur opened 4 years ago

alanmur commented 4 years ago

We need to add instructions on how to create a Cognito Identity Pool in the user's account so the unauthenticated player can invoke the client service Lambda. Presently we get:

Amazon.Lambda.AmazonLambdaException: User: arn:aws:sts::768788344492:assumed-role/Cognito_UltraFrogBattleRoyaleAnonPoolUnauth_Role/CognitoIdentityCredentials is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:768788344492:function:ConnectUltraFrogRoyaleClient ---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown. at Amazon.Runtime.Internal.UnityRequest.EndGetResponse (System.IAsyncResult asyncResult) [0x0000e] in <63c2de57b2a5496ca21edbdf1b5cf408>:0 at Amazon.Runtime.Internal.HttpHandler1[TRequestContent].GetResponseCallbackHelper (System.Object state) [0x00023] in <63c2de57b2a5496ca21edbdf1b5cf408>:0 --- End of inner exception stack trace --- at Amazon.Runtime.Internal.HttpErrorResponseExceptionHandler.HandleException (Amazon.Runtime.IExecutionContext executionContext, Amazon.Runtime.Internal.HttpErrorResponseException exception) [0x0013f] in <63c2de57b2a5496ca21edbdf1b5cf408>:0 at Amazon.Runtime.Internal.ExceptionHandler1[T].Handle (Amazon.Runtime.IExecutionContext executionContext, System.Exception exception) [0x00000] in <63c2de57b2a5496ca21edbdf1b5cf408>:0 at Amazon.Runtime.Internal.ErrorHandler.ProcessException (Amazon.Runtime.IExecutionContext executionContext, System.Exception exception) [0x0005c] in <63c2de57b2a5496ca21edbdf1b5cf408>:0 at Amazon.Runtime.Internal.ErrorHandler.InvokeAsyncCallback (Amazon.Runtime.IAsyncExecutionContext executionContext) [0x0002f] in <63c2de57b2a5496ca21edbdf1b5cf408>:0

alanmur commented 4 years ago

Basically the gist is the user should

  1. go to this URL in us-east-1
  2. Click Create New Identity Pool
  3. Enter the name UltraFrogRoyale for identity pool name
  4. Check "Enable access to unauthenticated identities" box
  5. Click Create Pool
  6. Click View Details.
  7. In the lower section where it says "Your unauthenticated identities would like access to Cognito." click View Policy document.
  8. Click Edit next to the greyed out json document.
  9. Replace the json with the json in this file.
  10. At line 10, change the resource ARN in the role to the resource ARN of your Lambda Function.

With all else being equal, the only thing that changes is the AWS account number, which is what we wanted.

  1. Click Allow. This creates the Identity pool and gives you a bit of sample code showing the Identity Pool ID (in red)
  2. Copy the red Identity Pool ID and paste it into the sample code here, in place of the one that was checked in.
  3. Rebuild the client according to the instructions.