30:T785,md` Store AWS credentials in local storage and call the AWS SDK. So far we have added IAM, S3 and CloudFront. If you need more SDK methods, create an web SDK distribution using https://sdk.amazonaws.com/builder/js/ ~~~js import { iam, s3, viewof manualCredentials, saveCreds. listObjects, getObject, putObject, listGroups, listGroupsForUser, addUserToGroup, removeUserFromGroup listUsers, createUser, deleteUser, getUser, listAccessKeys, createAccessKey, deleteAccessKey, listUserTags, tagUser, untagUser } with {REGION as REGION} from '@tomlarkworthy/aws' ~~~ I am a big fan of using resource tagging to provide attribute based access control (ABAC), as an alternative to API Gateway. With IAM policies, you can add a tag to an s3 object, and a tag to a user account, and express that "only users with the matching tag can access the file". Using wildcards and StringLike expressions, you can tag a user account with all projects they can access, and let them create files only with a matching project prefix. For example, the following AWS policy rule allows the authenticated IAM user (a.k.a. the Principle) to create a file with a "project" tag that matches one of the projects in their tag "projects" (space prefixed/suffixed/delimited) list. ~~~ { "Effect": "Allow", "Action": [ "s3:putObjectTagging" "s3:PutObject" ], "Resource": "arn:aws:s3:::myBucket/*", "Condition": { "StringLike": { "aws:PrincipalTag/projects": "* \${s3:RequestObjectTag/project} *" } } } ~~~ With the right IAM User Group policies and this AWS SDK wrapper you can build a quite powerful multi-tenancy file storage system without API gateway. Kinda like a Firebase Storage-lite. Don't underestimate tagging! For more info check out Amazon's documentation. https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging-and-policies.html `31:[{"id":"42a7af064086ea13afd59dd09481661f09943c6804c9569656218bc23bd70b7f7cf6681bda2ae79eba6ea147389fe57ae2e82788ff78a187ba3712ab8275ee14","href":"https://static.observableusercontent.com/files/42a7af064086ea13afd59dd09481661f09943c6804c9569656218bc23bd70b7f7cf6681bda2ae79eba6ea147389fe57ae2e82788ff78a187ba3712ab8275ee14","name":"aws-sdk-2.983.0.min.js","type":"application/javascript","lastModified":1630918054339.676,"size":461870}] 2e:{"title":"AWS Helpers","cells":[{"id":0,"value":"md`# AWS Helpers\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":315,"value":"$30","pinned":false,"hidden":false,"mode":"ojs"},{"id":153,"value":"AWS = require(await FileAttachment(\"aws-sdk-2.983.0.min.js\").url()).then(\n (_) => window[\"AWS\"]\n)","pinned":false,"hidden":false,"mode":"ojs"},{"id":44,"value":"md`# Credentials\n\nA credentials file can be used to derive *access_tokens* for SDK calls.\n~~~js\n{ \n \"accessKeyId\": ,\n \"secretAccessKey\": \n}\n~~~\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":35,"value":"md`## Input credentials\n\nNot persisted or shared outside of your local network. Paste an unencrypted JSON of your credentials in the following box to authenticate.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":38,"value":"viewof manualCredentials = {\n const existingCreds = localStorage.getItem(\n `AWS_CREDS_${btoa(htl.html``.href.split(\"?\")[0])}`\n );\n\n const control = Inputs.textarea({\n label: \"Supply AWS credentials as JSON\",\n rows: 6,\n minlength: 1,\n submit: true,\n value: existingCreds\n });\n\n const wrapped = htl.html`

\n \n ${control}`;\n Inputs.bind(wrapped, control);\n return wrapped;\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":527,"value":"saveCreds = htl.html`${Inputs.button(\n \"Save creds to local storage\",\n {\n reduce: () =>\n localStorage.setItem(\n `AWS_CREDS_${btoa(htl.html``.href.split(\"?\")[0])}`,\n manualCredentials\n )\n }\n)} ${Inputs.button(\"Clear stored creds\", {\n reduce: () =>\n localStorage.removeItem(\n `AWS_CREDS_${btoa(htl.html``.href.split(\"?\")[0])}`\n )\n})}`","pinned":false,"hidden":false,"mode":"ojs"},{"id":71,"value":"md`## Credentials`","pinned":false,"hidden":false,"mode":"ojs"},{"id":59,"value":"credentials = Generators.observe(next => {\n const check = () => {\n const creds = viewof manualCredentials.value;\n try {\n expect(creds).toBeDefined();\n const parsed = JSON.parse(creds);\n expect(parsed).toHaveProperty(\"accessKeyId\");\n expect(parsed).toHaveProperty(\"secretAccessKey\");\n next(parsed);\n } catch (err) {\n //next(err);\n }\n };\n\n viewof manualCredentials.addEventListener('input', check);\n invalidation.then(() => {\n viewof manualCredentials.removeEventListener('input', check);\n });\n check();\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":161,"value":"md`Use creds in SDK`","pinned":false,"hidden":false,"mode":"ojs"},{"id":157,"value":"login = {\n AWS.config.credentials = credentials;\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":150,"value":"md`# IAM`","pinned":false,"hidden":false,"mode":"ojs"},{"id":302,"value":"iam = login || new AWS.IAM()","pinned":false,"hidden":false,"mode":"ojs"},{"id":514,"value":"md`##### Users`","pinned":false,"hidden":false,"mode":"ojs"},{"id":305,"value":"listUsers = async () => {\n const response = await iam.listUsers().promise();\n return response.Users;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":300,"value":"createUser = async username => {\n const response = await iam\n .createUser({\n UserName: username\n })\n .promise();\n return response.User;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":453,"value":"deleteUser = async username => {\n const response = await iam\n .deleteUser({\n UserName: username\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":626,"value":"getUser = async username => {\n const response = await iam\n .getUser({\n ...(username && { UserName: username })\n })\n .promise();\n return response.User;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":511,"value":"md`##### Access Keys`","pinned":false,"hidden":false,"mode":"ojs"},{"id":469,"value":"listAccessKeys = async username => {\n const response = await iam\n .listAccessKeys({\n UserName: username\n })\n .promise();\n return response.AccessKeyMetadata;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":442,"value":"/*https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IAM.html#createAccessKey-property*/\ncreateAccessKey = async username => {\n const response = await iam\n .createAccessKey({\n UserName: username\n })\n .promise();\n return response.AccessKey;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":460,"value":"deleteAccessKey = async (username, accessKeyId) => {\n const response = await iam\n .deleteAccessKey({\n UserName: username,\n AccessKeyId: accessKeyId\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":493,"value":"md`##### User Tags`","pinned":false,"hidden":false,"mode":"ojs"},{"id":486,"value":"listUserTags = async username => {\n const response = await iam\n .listUserTags({\n UserName: username\n })\n .promise();\n return response.Tags.reduce(\n (acc, r) =>\n Object.defineProperty(acc, r.Key, { value: r.Value, enumerable: true }),\n {}\n );\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":492,"value":"// https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/IAM.html#tagUser-property\ntagUser = async (username, tagDictionary) => {\n const response = await iam\n .tagUser({\n Tags: Object.entries(tagDictionary).map(e => ({\n Key: e[0],\n Value: e[1]\n })),\n UserName: username\n })\n .promise();\n return response.Tags;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":503,"value":"untagUser = async (username, keyArray) => {\n const response = await iam\n .untagUser({\n TagKeys: keyArray,\n UserName: username\n })\n .promise();\n return response.Tags;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":592,"value":"md`##### IAM User groups`","pinned":false,"hidden":false,"mode":"ojs"},{"id":598,"value":"listGroups = async username => {\n const response = await iam.listGroups().promise();\n return response.Groups;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":602,"value":"listGroupsForUser = async username => {\n const response = await iam\n .listGroupsForUser({\n UserName: username\n })\n .promise();\n return response.Groups;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":607,"value":"addUserToGroup = async (username, group) => {\n return await iam\n .addUserToGroup({\n UserName: username,\n GroupName: group\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":615,"value":"removeUserFromGroup = async (username, group) => {\n return await iam\n .removeUserFromGroup({\n UserName: username,\n GroupName: group\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":164,"value":"md`# S3\n\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":272,"value":"md`S3 service doesn't work until you set a region, and you cannot create buckets through the SDK, you have to set them up in the console first, but you can add and remove files from a pre-existing bucket`","pinned":false,"hidden":false,"mode":"ojs"},{"id":249,"value":"REGION = 'us-east-2'","pinned":false,"hidden":false,"mode":"ojs"},{"id":174,"value":"s3 = login || new AWS.S3({ region: REGION })","pinned":false,"hidden":false,"mode":"ojs"},{"id":267,"value":"md`### CORS\n\nAWS S3 SDK does not work until you enable a CORS policy in the bucket permissions\n\n~~~js\n[\n {\n \"AllowedHeaders\": [\n \"*\"\n ],\n \"AllowedMethods\": [\n \"PUT\",\n \"GET\",\n \"HEAD\"\n ],\n \"AllowedOrigins\": [\n \"*\"\n ],\n \"ExposeHeaders\": [],\n \"MaxAgeSeconds\": 3000\n }\n]\n~~~\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":168,"value":"async function hasBucket(name) {\n return s3\n .getBucketLocation({\n Bucket: name\n })\n .promise()\n .then(() => true)\n .catch(err => false);\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":567,"value":"listObjects = async function (bucket, prefix = undefined, options = {}) {\n const response = await s3\n .listObjectsV2({\n Bucket: bucket,\n Delimiter: \"/\",\n ...(prefix && { Prefix: prefix }),\n ...options\n })\n .promise();\n return response.CommonPrefixes;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":226,"value":"getObject = async (bucket, path) => {\n const response = await s3\n .getObject({\n Bucket: bucket,\n Key: path\n })\n .promise();\n return response.Body;\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":297,"value":"putObject = async (bucket, path, value, options) => {\n const s3Options = { ...options };\n delete s3Options[\"tags\"];\n return s3\n .putObject({\n Bucket: bucket,\n Key: path,\n Body: value,\n ...(options?.tags && {\n Tagging: Object.entries(options.tags)\n .map((e) => `${e[0]}=${e[1]}`)\n .join(\"&\")\n }),\n ...s3Options\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":748,"value":"md`# CloudFront\n\n`","pinned":true,"hidden":false,"mode":"ojs"},{"id":754,"value":"cloudFront = login || new AWS.CloudFront()","pinned":true,"hidden":false,"mode":"ojs"},{"id":752,"value":"createInvalidation = (distributionId, paths = []) => {\n const operationId = randomId(16);\n return cloudFront\n .createInvalidation({\n DistributionId: distributionId,\n InvalidationBatch: {\n CallerReference: operationId,\n Paths: {\n Quantity: paths.length,\n Items: paths\n }\n }\n })\n .promise();\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":279,"value":"md`---`","pinned":false,"hidden":false,"mode":"ojs"},{"id":89,"value":"import { expect } from '@tomlarkworthy/testing'","pinned":false,"hidden":false,"mode":"ojs"},{"id":201,"value":"import { randomId } from '@tomlarkworthy/randomid'","pinned":false,"hidden":false,"mode":"ojs"},{"id":395,"value":"import { resize } from '@endpointservices/resize'","pinned":false,"hidden":false,"mode":"ojs"},{"id":536,"value":"import { localStorage } from \"@mbostock/safe-local-storage\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":721,"value":"import { signature } from '@mootari/signature'","pinned":false,"hidden":false,"mode":"ojs"}],"files":"$W31","stdlib":"1","titling":"auto"}