noppoMan / npdynamodb

A Node.js Simple Query Builder and ORM for AWS DynamoDB
112 stars 18 forks source link

Recommend best practices in README #28

Open TomFrost opened 9 years ago

TomFrost commented 9 years ago

From the README:

Note that, if you use Npdynamodb on any browsers, It has a security issue. Because AccessKey and SecretAccessKey for DynamoDB can be seen from public. We recommend you only using it for private or readonly projects which is not including any privacy informations.

This is misleading. The recommended way to interact with AWS from the frontend is to assume an IAM role and get temporary AWS credentials through Amazon STS. Cognito provides a very simple user-based way to make this happen, and allows public frontend applications to use AWS services directly and with finely-controlled security.

Thanks for picking up where Vogels left off and making this function on the frontend!