Manage Aws Cognito Userpool Hosted Domain with Serverless Framework

aws-cognito-idp-userpool-domain

description

With this plugin you will be able to manage a hosted aws domain to the Cognito Userpool with Serverless Framework.

You can find this and other plugins on Severless Community Plugins repository.

installation

$ npm install aws-cognito-idp-userpool-domain

npm package

https://www.npmjs.com/package/aws-cognito-idp-userpool-domain

Serverless.yml

service: myservice

plugins:
  - aws-cognito-idp-userpool-domain
custom:
  stage: ${opt:stage, self:provider.stage}  
  
provider:
  name: aws
  runtime: nodejs8.10
  profile: default
  region: us-east-1

AWS::Cognito::UserPool resource

Resources:
  MyUserpool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig: 
        AllowAdminCreateUserOnly: true
        InviteMessageTemplate:
          EmailMessage: Your username is {username} and temporary password is {####}.  
          EmailSubject: Your temporary password
          SMSMessage: Your username is {username} and temporary password is {####}.
        UnusedAccountValidityDays: 7
      UsernameAttributes: 
        - email
      AutoVerifiedAttributes: 
        - email
      EmailConfiguration: 
        ReplyToEmailAddress: donotreply@domain.tld
      EmailVerificationMessage: Your verification code is {####}.
      EmailVerificationSubject: Your verification code
      MfaConfiguration: OFF
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: false
          RequireUppercase: true
      UserPoolName: ${self:service}-${self:custom.stage}
  MyCognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: ${self:service}-${self:custom.stage}-user-pool-client
      UserPoolId:
        Ref: MyUserpool
      GenerateSecret: true

Deploy Output

# serverless deploy -v -s dev

Serverless: Packaging service...
Serverless: Creating Stack...
Serverless: Checking Stack create progress...
CloudFormation - CREATE_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - CREATE_IN_PROGRESS - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_IN_PROGRESS - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_COMPLETE - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_COMPLETE - AWS::CloudFormation::Stack - myservice-dev
Serverless: Stack create finished...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
CloudFormation - UPDATE_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_COMPLETE - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - CREATE_COMPLETE - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - UPDATE_COMPLETE_CLEANUP_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - UPDATE_COMPLETE - AWS::CloudFormation::Stack - myservice-dev
Serverless: Stack update finished...
Service Information
service: myservice
stage: dev
region: us-east-1
stack: myservice-dev
api keys:
 None
endpoints:
 None
functions:
 None

Stack Outputs
UserPoolIdMyUserpool: us-east-1_Ea2rfHMLF
ServerlessDeploymentBucketName: myservice-dev-serverlessdeploymentbucket-a34u7pvypfh

Plugin [aws-cognito-idp-userpool-domain]: process_deploy started.
Plugin [aws-cognito-idp-userpool-domain]: Creating user pool domain...
Plugin [aws-cognito-idp-userpool-domain]: userpoolid: [us-east-1_Ea2rfHMLF], domainname: [myservice-dev]
Plugin [aws-cognito-idp-userpool-domain]: domain created
Plugin [aws-cognito-idp-userpool-domain]: done.
Plugin [aws-cognito-idp-userpool-domain]: process_deploy finished.

Remove Output

# serverless remove

Plugin [aws-cognito-idp-userpool-domain]: process_remove started.
Plugin [aws-cognito-idp-userpool-domain]: Deleting user pool domain...
Plugin [aws-cognito-idp-userpool-domain]: userpoolid: [us-east-1_Ea2rfHMLF], domainname: [myservice-dev]
Plugin [aws-cognito-idp-userpool-domain]: domain deleted
Plugin [aws-cognito-idp-userpool-domain]: done.
Plugin [aws-cognito-idp-userpool-domain]: process_remove finished.
Serverless: Getting all objects in S3 bucket...
Serverless: Removing objects in S3 bucket...
Serverless: Removing Stack...
Serverless: Checking Stack removal progress...
.......
Serverless: Stack removal finished...

Author: Rubentrancoso
Source Code: https://github.com/rubentrancoso/aws-cognito-idp-userpool-domain
License:

#serverless #aws #domain

Manage Aws Cognito Userpool Hosted Domain with Serverless Framework

aws-cognito-idp-userpool-domain

description

With this plugin you will be able to manage a hosted aws domain to the Cognito Userpool with Serverless Framework.

You can find this and other plugins on Severless Community Plugins repository.

installation

$ npm install aws-cognito-idp-userpool-domain

npm package

https://www.npmjs.com/package/aws-cognito-idp-userpool-domain

Serverless.yml

service: myservice

plugins:
  - aws-cognito-idp-userpool-domain
custom:
  stage: ${opt:stage, self:provider.stage}  
  
provider:
  name: aws
  runtime: nodejs8.10
  profile: default
  region: us-east-1

AWS::Cognito::UserPool resource

Resources:
  MyUserpool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig: 
        AllowAdminCreateUserOnly: true
        InviteMessageTemplate:
          EmailMessage: Your username is {username} and temporary password is {####}.  
          EmailSubject: Your temporary password
          SMSMessage: Your username is {username} and temporary password is {####}.
        UnusedAccountValidityDays: 7
      UsernameAttributes: 
        - email
      AutoVerifiedAttributes: 
        - email
      EmailConfiguration: 
        ReplyToEmailAddress: donotreply@domain.tld
      EmailVerificationMessage: Your verification code is {####}.
      EmailVerificationSubject: Your verification code
      MfaConfiguration: OFF
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: false
          RequireUppercase: true
      UserPoolName: ${self:service}-${self:custom.stage}
  MyCognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: ${self:service}-${self:custom.stage}-user-pool-client
      UserPoolId:
        Ref: MyUserpool
      GenerateSecret: true

Deploy Output

# serverless deploy -v -s dev

Serverless: Packaging service...
Serverless: Creating Stack...
Serverless: Checking Stack create progress...
CloudFormation - CREATE_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - CREATE_IN_PROGRESS - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_IN_PROGRESS - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_COMPLETE - AWS::S3::Bucket - ServerlessDeploymentBucket
CloudFormation - CREATE_COMPLETE - AWS::CloudFormation::Stack - myservice-dev
Serverless: Stack create finished...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
CloudFormation - UPDATE_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_COMPLETE - AWS::Cognito::UserPool - MyUserpool
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - CREATE_IN_PROGRESS - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - CREATE_COMPLETE - AWS::Cognito::UserPoolClient - MyCognitoUserPoolClient
CloudFormation - UPDATE_COMPLETE_CLEANUP_IN_PROGRESS - AWS::CloudFormation::Stack - myservice-dev
CloudFormation - UPDATE_COMPLETE - AWS::CloudFormation::Stack - myservice-dev
Serverless: Stack update finished...
Service Information
service: myservice
stage: dev
region: us-east-1
stack: myservice-dev
api keys:
 None
endpoints:
 None
functions:
 None

Stack Outputs
UserPoolIdMyUserpool: us-east-1_Ea2rfHMLF
ServerlessDeploymentBucketName: myservice-dev-serverlessdeploymentbucket-a34u7pvypfh

Plugin [aws-cognito-idp-userpool-domain]: process_deploy started.
Plugin [aws-cognito-idp-userpool-domain]: Creating user pool domain...
Plugin [aws-cognito-idp-userpool-domain]: userpoolid: [us-east-1_Ea2rfHMLF], domainname: [myservice-dev]
Plugin [aws-cognito-idp-userpool-domain]: domain created
Plugin [aws-cognito-idp-userpool-domain]: done.
Plugin [aws-cognito-idp-userpool-domain]: process_deploy finished.

Remove Output

# serverless remove

Plugin [aws-cognito-idp-userpool-domain]: process_remove started.
Plugin [aws-cognito-idp-userpool-domain]: Deleting user pool domain...
Plugin [aws-cognito-idp-userpool-domain]: userpoolid: [us-east-1_Ea2rfHMLF], domainname: [myservice-dev]
Plugin [aws-cognito-idp-userpool-domain]: domain deleted
Plugin [aws-cognito-idp-userpool-domain]: done.
Plugin [aws-cognito-idp-userpool-domain]: process_remove finished.
Serverless: Getting all objects in S3 bucket...
Serverless: Removing objects in S3 bucket...
Serverless: Removing Stack...
Serverless: Checking Stack removal progress...
.......
Serverless: Stack removal finished...

Author: Rubentrancoso
Source Code: https://github.com/rubentrancoso/aws-cognito-idp-userpool-domain
License:

#serverless #aws #domain

Christa Stehr

1598408880

How To Unite AWS KMS with Serverless Application Model (SAM)

The Basics

AWS KMS is a Key Management Service that let you create Cryptographic keys that you can use to encrypt and decrypt data and also other keys. You can read more about it here.

Important points about Keys

Please note that the customer master keys(CMK) generated can only be used to encrypt small amount of data like passwords, RSA key. You can use AWS KMS CMKs to generate, encrypt, and decrypt data keys. However, AWS KMS does not store, manage, or track your data keys, or perform cryptographic operations with data keys.

You must use and manage data keys outside of AWS KMS. KMS API uses AWS KMS CMK in the encryption operations and they cannot accept more than 4 KB (4096 bytes) of data. To encrypt application data, use the server-side encryption features of an AWS service, or a client-side encryption library, such as the AWS Encryption SDK or the Amazon S3 encryption client.

Scenario

We want to create signup and login forms for a website.

Passwords should be encrypted and stored in DynamoDB database.

What do we need?

KMS key to encrypt and decrypt data
DynamoDB table to store password.
Lambda functions & APIs to process Login and Sign up forms.
Sign up/ Login forms in HTML.

Lets Implement it as Serverless Application Model (SAM)!

Lets first create the Key that we will use to encrypt and decrypt password.

KmsKey:
    Type: AWS::KMS::Key
    Properties: 
      Description: CMK for encrypting and decrypting
      KeyPolicy:
        Version: '2012-10-17'
        Id: key-default-1
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
          Action: kms:*
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:user/${KeyAdmin}
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:user/${KeyUser}
          Action:
          - kms:DescribeKey
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt*
          - kms:GenerateDataKey
          - kms:GenerateDataKeyWithoutPlaintext
          Resource: '*'

The important thing in above snippet is the KeyPolicy. KMS requires a Key Administrator and Key User. As a best practice your Key Administrator and Key User should be 2 separate user in your Organisation. We are allowing all permissions to the root users.

So if your key Administrator leaves the organisation, the root user will be able to delete this key. As you can see **KeyAdmin **can manage the key but not use it and KeyUser can only use the key. ${KeyAdmin} and **${KeyUser} **are parameters in the SAM template.

You would be asked to provide values for these parameters during SAM Deploy.

#aws #serverless #aws-sam #aws-key-management-service #aws-certification #aws-api-gateway #tutorial-for-beginners #aws-blogs

Hermann Frami

1655426640

Serverless Plugin for Microservice Code Management and Deployment

Serverless M

Serverless M (or Serverless Modular) is a plugin for the serverless framework. This plugins helps you in managing multiple serverless projects with a single serverless.yml file. This plugin gives you a super charged CLI options that you can use to create new features, build them in a single file and deploy them all in parallel

Currently this plugin is tested for the below stack only

AWS
NodeJS λ
Rest API (You can use other events as well)

Prerequisites

Make sure you have the serverless CLI installed

# Install serverless globally
$ npm install serverless -g

Getting Started

To start the serverless modular project locally you can either start with es5 or es6 templates or add it as a plugin

ES6 Template install

# Step 1. Download the template
$ sls create --template-url https://github.com/aa2kb/serverless-modular/tree/master/template/modular-es6 --path myModularService

# Step 2. Change directory
$ cd myModularService

# Step 3. Create a package.json file
$ npm init

# Step 3. Install dependencies
$ npm i serverless-modular serverless-webpack webpack --save-dev

ES5 Template install

# Step 1. Download the template
$ sls create --template-url https://github.com/aa2kb/serverless-modular/tree/master/template/modular-es5 --path myModularService

# Step 2. Change directory
$ cd myModularService

# Step 3. Create a package.json file
$ npm init

# Step 3. Install dependencies
$ npm i serverless-modular --save-dev

If you dont want to use the templates above you can just add in your existing project

Adding it as plugin

plugins:
  - serverless-modular

Now you are all done to start building your serverless modular functions

API Reference

The serverless CLI can be accessed by

# Serverless Modular CLI
$ serverless modular

# shorthand
$ sls m

Serverless Modular CLI is based on 4 main commands

sls m init
sls m feature
sls m function
sls m build
sls m deploy

init command

sls m init

The serverless init command helps in creating a basic .gitignore that is useful for serverless modular.

The basic .gitignore for serverless modular looks like this

#node_modules
node_modules

#sm main functions
sm.functions.yml

#serverless file generated by build
src/**/serverless.yml

#main serverless directories generated for sls deploy
.serverless

#feature serverless directories generated sls deploy
src/**/.serverless

#serverless logs file generated for main sls deploy
.sm.log

#serverless logs file generated for feature sls deploy
src/**/.sm.log

#Webpack config copied in each feature
src/**/webpack.config.js

feature command

The feature command helps in building new features for your project

options (feature Command)

This command comes with three options

--name: Specify the name you want for your feature

--remove: set value to true if you want to remove the feature

--basePath: Specify the basepath you want for your feature, this base path should be unique for all features. helps in running offline with offline plugin and for API Gateway

options	shortcut	required	values	default value
--name	-n	✅	string	N/A
--remove	-r	❎	true, false	false
--basePath	-p	❎	string	same as name

Examples (feature Command)

Creating a basic feature

# Creating a jedi feature
$ sls m feature -n jedi

Creating a feature with different base path

# A feature with different base path
$ sls m feature -n jedi -p tatooine

Deleting a feature

# Anakin is going to delete the jedi feature
$ sls m feature -n jedi -r true

function command

The function command helps in adding new function to a feature

options (function Command)

This command comes with four options

--name: Specify the name you want for your function

--feature: Specify the name of the existing feature

--path: Specify the path for HTTP endpoint helps in running offline with offline plugin and for API Gateway

--method: Specify the path for HTTP method helps in running offline with offline plugin and for API Gateway

options	shortcut	required	values	default value
--name	-n	✅	string	N/A
--feature	-f	✅	string	N/A
--path	-p	❎	string	same as name
--method	-m	❎	string	'GET'

Examples (function Command)

Creating a basic function

# Creating a cloak function for jedi feature
$ sls m function -n cloak -f jedi

Creating a basic function with different path and method

# Creating a cloak function for jedi feature with custom path and HTTP method
$ sls m function -n cloak -f jedi -p powers -m POST

build command

The build command helps in building the project for local or global scope

options (build Command)

This command comes with four options

--scope: Specify the scope of the build, use this with "--feature" tag

--feature: Specify the name of the existing feature you want to build

options	shortcut	required	values	default value
--scope	-s	❎	string	local
--feature	-f	❎	string	N/A

Saving build Config in serverless.yml

You can also save config in serverless.yml file

custom:
  smConfig:
    build:
      scope: local

Examples (build Command)

all feature build (local scope)

# Building all local features
$ sls m build

Single feature build (local scope)

# Building a single feature
$ sls m build -f jedi -s local

All features build global scope

# Building all features with global scope
$ sls m build -s global

deploy command

The deploy command helps in deploying serverless projects to AWS (it uses sls deploy command)

options (deploy Command)

This command comes with four options

--sm-parallel: Specify if you want to deploy parallel (will only run in parallel when doing multiple deployments)

--sm-scope: Specify if you want to deploy local features or global

--sm-features: Specify the local features you want to deploy (comma separated if multiple)

options	shortcut	required	values	default value
--sm-parallel	❎	❎	true, false	true
--sm-scope	❎	❎	local, global	local
--sm-features	❎	❎	string	N/A
--sm-ignore-build	❎	❎	string	false

Saving deploy Config in serverless.yml

You can also save config in serverless.yml file

custom:
  smConfig:
    deploy:
      scope: local
      parallel: true
      ignoreBuild: true

Examples (deploy Command)

Deploy all features locally

# deploy all local features
$ sls m deploy

Deploy all features globally

# deploy all global features
$ sls m deploy --sm-scope global

Deploy single feature

# deploy all global features
$ sls m deploy --sm-features jedi

Deploy Multiple features

# deploy all global features
$ sls m deploy --sm-features jedi,sith,dark_side

Deploy Multiple features in sequence

# deploy all global features
$ sls m deploy  --sm-features jedi,sith,dark_side --sm-parallel false

Author: aa2kb
Source Code: https://github.com/aa2kb/serverless-modular
License: MIT license

#serverless #aws #node #lambda

Jamar Hodkiewicz

1616247660

One-step AWS Cognito User Pool with Lambda Triggers using Serverless Framework

Deploy your Cognito user pool and custom triggers in one Serverless stack and understand Serverless a little bit better along the way.

Serverless Framework gives you the ability to create a Cognito User Pool, fully configure it, and add custom lambda triggers to it, all in one deployment step.

Creating a User Pool

Let’s start by setting up a simple Cognito User Pool in the Resources section of our Serverless stack:

service: cognito-trigger-example

provider:
  name: aws
  runtime: nodejs12.x

resources:
  Resources:
    CognitoUserPoolMikesExamplePool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: mikes-example-pool
        UsernameAttributes:
          - email
        AutoVerifiedAttributes:
          - email

#aws #cognito #aws-lambda #serverless

Seamus Quitzon

1601341562

AWS Cost Allocation Tags and Cost Reduction

Bob had just arrived in the office for his first day of work as the newly hired chief technical officer when he was called into a conference room by the president, Martha, who immediately introduced him to the head of accounting, Amanda. They exchanged pleasantries, and then Martha got right down to business:

“Bob, we have several teams here developing software applications on Amazon and our bill is very high. We think it’s unnecessarily high, and we’d like you to look into it and bring it under control.”

Martha placed a screenshot of the Amazon Web Services (AWS) billing report on the table and pointed to it.

“This is a problem for us: We don’t know what we’re spending this money on, and we need to see more detail.”

Amanda chimed in, “Bob, look, we have financial dimensions that we use for reporting purposes, and I can provide you with some guidance regarding some information we’d really like to see such that the reports that are ultimately produced mirror these dimensions — if you can do this, it would really help us internally.”

“Bob, we can’t stress how important this is right now. These projects are becoming very expensive for our business,” Martha reiterated.

“How many projects do we have?” Bob inquired.

“We have four projects in total: two in the aviation division and two in the energy division. If it matters, the aviation division has 75 developers and the energy division has 25 developers,” the CEO responded.

Bob understood the problem and responded, “I’ll see what I can do and have some ideas. I might not be able to give you retrospective insight, but going forward, we should be able to get a better idea of what’s going on and start to bring the cost down.”

The meeting ended with Bob heading to find his desk. Cost allocation tags should help us, he thought to himself as he looked for someone who might know where his office is.

#aws #aws cloud #node js #cost optimization #aws cli #well architected framework #aws cost report #cost control #aws cost #aws tags

Manage Aws Cognito Userpool Hosted Domain with Serverless Framework

description

installation

npm package

Serverless.yml

AWS::Cognito::UserPool resource

# serverless deploy -v -s dev

# serverless remove

What is GEEK

Buddha Community

Manage Aws Cognito Userpool Hosted Domain with Serverless Framework

description

installation

npm package

Serverless.yml

AWS::Cognito::UserPool resource

# serverless deploy -v -s dev

# serverless remove

How To Unite AWS KMS with Serverless Application Model (SAM)

Serverless Plugin for Microservice Code Management and Deployment

Serverless M

Prerequisites

Getting Started

ES6 Template install

ES5 Template install

Adding it as plugin

API Reference

init command

feature command

options (feature Command)

Examples (feature Command)

function command

options (function Command)

Examples (function Command)

build command

options (build Command)

Examples (build Command)

deploy command

options (deploy Command)

Examples (deploy Command)

One-step AWS Cognito User Pool with Lambda Triggers using Serverless Framework

Deploy your Cognito user pool and custom triggers in one Serverless stack and understand Serverless a little bit better along the way.

Creating a User Pool

AWS Cost Allocation Tags and Cost Reduction