search

mlevit / aws-auto-cleanup

Programmatically delete AWS resources based on an allowlist and time to live (TTL) settings
MIT License
496 stars 55 forks source link

Cognito support for Web feature #71

Closed troydieter closed 3 years ago

troydieter commented 3 years ago

Is your feature request related to a problem? Please describe. Add a secondary module that secures the Web deployment with AWS Cognito.

Describe the solution you'd like For API - limit access to only the web portion using an AWS IAM role & associated policy to add items to the DDB table\whitelist. For Web - AWS Cognito secured through a user pool

Describe alternatives you've considered JWT authorizer, but figured it'd be easier with limiting API access through an AWS IAM Role with an IAM policy granting access.

Additional context Current access for web seems to be Wide Open Web, restricting this.

mlevit commented 3 years ago

Hey @troydieter,

Thanks for raising the feature requests. I've been thinking about this for a while too but not exactly sure the best route to take. Would love some feedback from yourself or the community.

Whilst there are a few things I can do that aren't so complex (i.e., make the API private and accessible via API keys), some things like Cognito integration is probably a little more complex and may not lend itself well to all users.

If there's any documentation/material you think could help please send my way.

mlevit commented 3 years ago

@troydieter have a look at the recent PR from @miki79 #79. I think it's a great balance between security and ease of use that just might be enough.

troydieter commented 3 years ago

@troydieter have a look at the recent PR from @miki79 #79. I think it's a great balance between security and ease of use that just might be enough.

Thanks Marat and @miki79 ! Looks good, and simple enough to integrate with on the serverless stack. I'll start testing with it.