You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Update coreHTTP S3 Download Instructions
* Revert to 85d531916
* Update comment for S3 Root CA in Upload and Download Multithreaded demos
* Wrap changes to 80 characters
* Uncrustify: triggered by comment.
* Run Github Actions.
* Fix broken section link in README
* Wrap README text on 90 characters
* Uncrustify: triggered by comment.
* Run Github Actions
---------
Co-authored-by: GitHub Action <[email protected]>
# Configure HTTP S3 Download Demo using SigV4 Library.
1
+
# Configure HTTP S3 Download Demo using SigV4 Library
2
2
3
3
Following steps needs to be followed to configure HTTP S3 Download Demo to use SigV4 library for authenticating the requests sent to AWS S3.
4
4
5
-
###Prerequisites
5
+
## Prerequisites
6
6
7
-
1. You will need an AWS Account with S3 access before beginning. You must be familiar with AWS IoT and IAM to perform steps using the AWS CLI. You must install and configure the AWS CLI in order to follow the steps.
8
-
For information on AWS S3 please see: https://docs.aws.amazon.com/AmazonS3/latest/dev/Welcome.html
9
-
For AWS CLI installation information please see: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html
10
-
For AWS CLI configuration information please see: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html
7
+
1. You will need an AWS Account with S3 access before beginning. You must be familiar with
8
+
AWS IoT and IAM to perform steps using the AWS CLI. You must install and configure the AWS
If your AWS IoT Thing already has a certificate attached to it, then that certificate's ARN can be used in [step 5](#5. attach-a-policy). Otherwise, you can create a certificate and attach it to the thing through IoT Core in the AWS Management Console UI. By doing any of these, you may skip to [step 3](#3-configure-an-iam-role).
38
+
If your AWS IoT Thing already has a certificate attached to it, then that certificate's
39
+
ARN can be used in [step 5](#5-attach-a-policy). Otherwise, you can create a certificate
40
+
and attach it to the thing through IoT Core in the AWS Management Console UI. By doing
41
+
any of these, you may skip to [step 3](#3-configure-an-iam-role).
30
42
31
-
It is also possible to sign the Thing's certificate using your own Certificate Authority (CA) certificate, and register both certificates with AWS IoT before your device can authenticate to AWS IoT. If you do not already have a CA certificate, you can use OpenSSL to create a CA certificate, as described in [Use Your Own Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html). To register your CA certificate with AWS IoT, follow the steps on [Registering Your CA Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html#register-CA-cert).
43
+
It is also possible to sign the Thing's certificate using your own Certificate Authority
44
+
(CA) certificate, and register both certificates with AWS IoT before your device can
45
+
authenticate to AWS IoT. If you do not already have a CA certificate, you can use OpenSSL
46
+
to create a CA certificate, as described in
47
+
[Use Your Own Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html).
48
+
To register your CA certificate with AWS IoT, follow the steps on
49
+
[Registering Your CA Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html#register-CA-cert).
32
50
33
-
You then have to create a device certificate signed by the CA certificate and register it with AWS IoT, which you can do by following the steps on [Creating a Device Certificate Using Your CA Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html#create-device-cert). Save the certificate and the corresponding key pair; you will use them when you request a security token later. Also, remember the password you provide when you create the certificate.
51
+
You then have to create a device certificate signed by the CA certificate and register it
52
+
with AWS IoT, which you can do by following the steps on
53
+
[Creating a Device Certificate Using Your CA Certificate](https://docs.aws.amazon.com/iot/latest/developerguide/device-certs-your-own.html#create-device-cert).
54
+
Save the certificate and the corresponding key pair; you will use them when you request a
55
+
security token later. Also, remember the password you provide when you create the
56
+
certificate.
34
57
35
-
Run the following command in the AWS CLI to attach the device certificate to your thing so that you can use thing attributes in policy variables.
58
+
Run the following command in the AWS CLI to attach the device certificate to your thing
59
+
so that you can use thing attributes in policy variables.
Next, configure an IAM role in your AWS account that will be assumed by the credentials provider on behalf of your device. You are required to associate two policies with the role: a trust policy that controls who can assume the role, and an access policy that controls which actions can be performed on which resources by assuming the role.
67
+
Next, configure an IAM role in your AWS account that will be assumed by the credentials
68
+
provider on behalf of your device. You are required to associate two policies with the
69
+
role: a trust policy that controls who can assume the role, and an access policy that
70
+
controls which actions can be performed on which resources by assuming the role.
44
71
45
-
The following trust policy grants the credentials provider permission to assume the role. Put it in a text document and save the document with the name, trustpolicyforiot.json.
72
+
The following trust policy grants the credentials provider permission to assume the role.
73
+
Put it in a text document and save the document with the name, trustpolicyforiot.json.
46
74
47
-
```
75
+
```json
48
76
{
49
77
"Version": "2012-10-17",
50
78
"Statement": {
@@ -54,13 +82,20 @@ The following trust policy grants the credentials provider permission to assume
54
82
}
55
83
}
56
84
```
57
-
Run the following command in the AWS CLI to create an IAM role with the preceding trust policy.
85
+
86
+
Run the following command in the AWS CLI to create an IAM role with the preceding trust
87
+
policy.
58
88
59
89
```sh
60
90
aws iam create-role --role-name s3-access-role --assume-role-policy-document file://trustpolicyforiot.json
61
91
```
62
-
The following s3 access policy allows you to perform actions on S3. Put the following policy in a text document and save the document with the name `accesspolicyfors3.json`.
63
-
```
92
+
93
+
The following s3 access policy allows you to perform actions on S3. Put the
94
+
following policy in a text document and save the document with the name
95
+
`accesspolicyfors3.json`. Make Sure to replace "BUCKET_NAME" with the name
96
+
of the S3 bucket you are using for this demo.
97
+
98
+
```json
64
99
{
65
100
"Version": "2012-10-17",
66
101
"Statement": {
@@ -72,19 +107,29 @@ The following s3 access policy allows you to perform actions on S3. Put the foll
72
107
}
73
108
}
74
109
```
110
+
75
111
Run the following command in the AWS CLI to create the access policy.
112
+
76
113
```sh
77
114
aws iam create-policy --policy-name accesspolicyfors3 --policy-document file://accesspolicyfors3.json
78
115
```
116
+
79
117
Finally, run the following command in the AWS CLI to attach the access policy to your role.
118
+
80
119
```sh
81
120
aws iam attach-role-policy --role-name s3-access-role --policy-arn arn:aws:iam::<your_aws_account_id>:policy/accesspolicyfors3
82
121
```
83
122
84
123
Configure the PassRole permissions
85
124
86
-
The IAM role that you have created must be passed to AWS IoT to create a role alias, as described in Step 4. The IAM user who performs the operation requires `iam:PassRole` permission to authorize this action. You also should add permission for the `iam:GetRole` action to allow the IAM user to retrieve information about the specified role. Create the following policy to grant `iam:PassRole` and `iam:GetRole` permissions. Name this policy `passrolepermission.json`.
87
-
```
125
+
The IAM role that you have created must be passed to AWS IoT to create a role alias, as
126
+
described in Step 4. The IAM user who performs the operation requires `iam:PassRole`
127
+
permission to authorize this action. You also should add permission for the `iam:GetRole`
128
+
action to allow the IAM user to retrieve information about the specified role. Create the
129
+
following policy to grant `iam:PassRole` and `iam:GetRole` permissions. Name this policy
130
+
`passrolepermission.json`.
131
+
132
+
```json
88
133
{
89
134
"Version": "2012-10-17",
90
135
"Statement": {
@@ -99,33 +144,51 @@ The IAM role that you have created must be passed to AWS IoT to create a role al
99
144
```
100
145
101
146
Run the following command in the AWS CLI to create the policy in your AWS account.
147
+
102
148
```sh
103
149
aws iam create-policy --policy-name passrolepermission --policy-document file://passrolepermission.json
104
150
```
105
151
106
152
Now, run the following command to attach the policy to the IAM user.
153
+
107
154
```sh
108
155
aws iam attach-user-policy --policy-arn arn:aws:iam::<your_aws_account_id>:policy/passrolepermission --user-name <user_name>
109
156
```
110
157
111
-
#### 4. Create a role alias:
158
+
#### 4. Create a role alias
159
+
160
+
Now that you have configured the IAM role, you will create a role alias with AWS IoT.
161
+
You must provide the following pieces of information when creating a role alias:
162
+
163
+
RoleAlias: This is the primary key of the role alias data model and hence a mandatory
164
+
attribute. It is a string; the minimum length is 1 character, and the maximum length is
165
+
128 characters.
112
166
113
-
Now that you have configured the IAM role, you will create a role alias with AWS IoT. You must provide the following pieces of information when creating a role alias:
167
+
RoleArn: This is the
168
+
[Amazon Resource Name (ARN)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
169
+
of the IAM role you have created. This is also a mandatory attribute.
114
170
115
-
RoleAlias: This is the primary key of the role alias data model and hence a mandatory attribute. It is a string; the minimum length is 1 character, and the maximum length is 128 characters.
171
+
CredentialDurationSeconds: This is an optional attribute specifying the validity
172
+
(in seconds) of the security token. The minimum value is 900 seconds (15 minutes),
173
+
and the maximum value is 43,200 seconds (12 hours); the default value is 3,600 seconds,
174
+
if not specified.
116
175
117
-
RoleArn: This is the [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of the IAM role you have created. This is also a mandatory attribute.
176
+
**Note**: The credentialDurationSeconds value must be less than or equal to the
177
+
maximum session duration of the IAM role that the role alias references,
178
+
otherwise the request will be rejected by the credentials provider.
118
179
119
-
CredentialDurationSeconds: This is an optional attribute specifying the validity (in seconds) of the security token. The minimum value is 900 seconds (15 minutes), and the maximum value is 3,600 seconds (60 minutes); the default value is 3,600 seconds, if not specified.
180
+
Run the following command in the AWS CLI to create a role alias. Use the credentials of
181
+
the user to whom you have given the iam:PassRole permission.
120
182
121
-
Run the following command in the AWS CLI to create a role alias. Use the credentials of the user to whom you have given the iam:PassRole permission.
You created and registered a certificate with AWS IoT earlier for successful authentication of your device. Now, you need to create and attach a policy to the certificate to authorize the request for the security token.
128
-
```
190
+
191
+
```json
129
192
{
130
193
"Version": "2012-10-17",
131
194
"Statement": [
@@ -137,65 +200,50 @@ You created and registered a certificate with AWS IoT earlier for successful aut
137
200
]
138
201
}
139
202
```
203
+
140
204
Run the following command in the AWS CLI to create the policy in your AWS IoT database.
Make an HTTPS request to the credentials provider to fetch a security token. You have to supply the following information:
216
+
#### 6. Obtain the Credentials Provider Endpoint
152
217
153
-
Certificate and key pair: Because this is an HTTP request over TLS mutual authentication, you have to provide the certificate and the corresponding key pair to your client while making the request. Use the same certificate and key pair that you used during certificate registration with AWS IoT.
154
-
155
-
RoleAlias: Provide the role alias (in this example, Thermostat-dynamodb-access-role-alias) to be assumed in the request.
156
-
157
-
ThingName: Provide the thing name that you created earlier in the AWS IoT thing registry database. This is passed as a header with the name, x-amzn-iot-thingname. Note that the thing name is mandatory only if you have thing attributes as policy variables in AWS IoT or IAM policies.
158
-
159
-
Run the following command in the AWS CLI to obtain your AWS account-specific endpoint for the credentials provider. See the [DescribeEndpoint API documentation](https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEndpoint.html) for further details.
218
+
Run the following command in the AWS CLI to obtain your AWS account-specific
219
+
endpoint for the credentials provider. See the
220
+
[DescribeEndpoint API documentation](https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEndpoint.html)
0 commit comments