Serverless app with identity federation
Adrian Cantrill presented an excellent demonstration to guide you through implementing Identity federation in your project using Google and AWS Cognito.
The workshop featured a setup with a serverless application and an appbucket containing an HTML file and a JS file distributed by CloudFront.
While most of the labs do not emphasize coding, I always find myself exploring the code whenever possible.
This time, a portion of the lambda code that involved copying objects to buckets included a set comprehension, which was initially challenging to grasp. Although it remains somewhat complex, the concept became clearer with further examination.
To start, create an OAuth external Google API project and OAuth client ID, and set up credentials for the serverless application to interact with the Google identity provider.
Next, establish a Cognito identity pool and make a note of the Identity Pool ID (which needs to be added to Google).
Adjust the trust relationship of the IAM role to indicate that the Cognito identity pool can assume the role to acquire temporary credentials and access images in the private bucket.
Modify the original index.html and script.js files to enable the exchange of Google token with AWS Cognito credentials, generate signed URLs for each S3 object, and allow the application to fetch and display the private images.
Comments