Skip to content

Commit 30b25c1

Browse files
tiffanynwyeungtiffanynwyeung
committed
reorder guest and auth'd user examples, update backend code examples to use CDK bucket construct
1 parent b956d7b commit 30b25c1

File tree

1 file changed

+118
-80
lines changed
  • src/pages/[platform]/build-a-backend/storage/use-with-custom-s3

1 file changed

+118
-80
lines changed

‎src/pages/[platform]/build-a-backend/storage/use-with-custom-s3/index.mdx

Lines changed: 118 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -93,33 +93,45 @@ If you specify a custom S3 bucket, no sandbox storage resource will be created.
9393
Below are several examples of configuring the backend to define a custom S3 bucket:
9494

9595
<BlockSwitcher>
96-
<Block name="Authenticated Users">
97-
Below is an example of expanding the original backend object to grant all authenticated (i.e. signed in) users with full access to files under `public/`:
96+
<Block name="Guest Users">
97+
Below is an example of expanding the original backend object to grant all guest (i.e. not signed in) users read access to files under `public/`:
98+
9899
```ts title="amplify/backend.ts"
99-
import { defineBackend } from "@aws-amplify/backend";
100+
import { defineBackend } from '@aws-amplify/backend';
101+
import { Effect, Policy, PolicyStatement } from 'aws-cdk-lib/aws-iam';
102+
import { Bucket } from 'aws-cdk-lib/aws-s3';
100103
import { auth } from "./auth/resource";
101104

102105
const backend = defineBackend({
103106
auth,
104107
});
105108
// highlight-start
109+
const customBucketStack = backend.createStack("custom-bucket-stack");
110+
111+
// Import existing bucket
112+
const customBucket = Bucket.fromBucketAttributes(bucketStack, "MyCustomBucket", {
113+
bucketArn: "arn:aws:s3:::<bucket-name>",
114+
region: "<region>"
115+
});
116+
106117
backend.addOutput({
107118
storage: {
108-
aws_region: "<region>",
109-
bucket_name: "<bucket-name>",
119+
aws_region: customBucket.env.region,
120+
bucket_name: customBucket.bucketName,
110121
// optional: `buckets` can be used when setting up more than one existing bucket
111122
buckets: [
112123
{
113-
aws_region: "<region>",
114-
bucket_name: "<bucket-name>",
115-
name: "<bucket-name>",
124+
aws_region: customBucket.env.region,
125+
bucket_name: customBucket.bucketName,
126+
name: customBucket.bucketName,
116127
/*
117128
optional: `paths` can be used to set up access to specific
118129
bucket prefixes and configure user access types to them
119130
*/
120131
paths: {
121132
"public/*": {
122-
authenticated: ["get", "list", "write", "delete"],
133+
// "write" and "delete" can also be added depending on your use case
134+
guest: ["get", "list"],
123135
},
124136
},
125137
}
@@ -128,131 +140,149 @@ backend.addOutput({
128140
});
129141

130142
/*
131-
Define an inline policy to attach to Amplify's auth role
132-
This policy defines how authenticated users can access your existing bucket
143+
Define an inline policy to attach to Amplify's unauth role
144+
This policy defines how unauthenticated/guest users can access your existing bucket
133145
*/
134-
const authPolicy = new Policy(backend.stack, "customBucketAuthPolicy", {
146+
const unauthPolicy = new Policy(backend.stack, "customBucketUnauthPolicy", {
135147
statements: [
136148
new PolicyStatement({
137149
effect: Effect.ALLOW,
138-
actions: [
139-
"s3:GetObject",
140-
"s3:PutObject",
141-
"s3:DeleteObject"
142-
],
143-
resources: ["arn:aws:s3:::<bucket-name>/public/*",],
150+
actions: ["s3:GetObject"],
151+
resources: [`${customBucket.bucketArn}/public/*`],
144152
}),
145153
new PolicyStatement({
146154
effect: Effect.ALLOW,
147155
actions: ["s3:ListBucket"],
148156
resources: [
149-
"arn:aws:s3:::<bucket-name>",
150-
"arn:aws:s3:::<bucket-name>/*"
151-
],
157+
`${customBucket.bucketArn}`,
158+
`${customBucket.bucketArn}/*`
159+
],
152160
conditions: {
153161
StringLike: {
154-
"s3:prefix": ["public/*", "public/"],
162+
"s3:prefix": ["public/", "public/*"],
155163
},
156164
},
157165
}),
158166
],
159167
});
160168

161-
// Add the policies to the authenticated user role
162-
backend.auth.resources.authenticatedUserIamRole.attachInlinePolicy(authPolicy);
169+
// Add the policies to the unauthenticated user role
170+
backend.auth.resources.unauthenticatedUserIamRole.attachInlinePolicy(
171+
unauthPolicy,
172+
);
163173
// highlight-end
164174
```
165175
</Block>
166-
<Block name="Guest Users">
167-
Below is an example of expanding the original backend object to grant all guest (i.e. not signed in) users read access to files under `public/`:
168-
176+
<Block name="Authenticated Users">
177+
Below is an example of expanding the original backend object to grant all authenticated (i.e. signed in) users with full access to files under `public/`:
169178
```ts title="amplify/backend.ts"
170-
import { defineBackend } from "@aws-amplify/backend";
179+
import { defineBackend } from '@aws-amplify/backend';
180+
import { Effect, Policy, PolicyStatement } from 'aws-cdk-lib/aws-iam';
181+
import { Bucket } from 'aws-cdk-lib/aws-s3';
171182
import { auth } from "./auth/resource";
172183

173184
const backend = defineBackend({
174185
auth,
175186
});
176187

188+
const customBucketStack = backend.createStack("custom-bucket-stack");
189+
190+
// Import existing bucket
191+
const customBucket = Bucket.fromBucketAttributes(bucketStack, "MyCustomBucket", {
192+
bucketArn: "arn:aws:s3:::<bucket-name>",
193+
region: "<region>"
194+
});
195+
177196
backend.addOutput({
178197
storage: {
179-
aws_region: "<region>",
180-
bucket_name: "<bucket-name>",
198+
aws_region: customBucket.env.region,
199+
bucket_name: customBucket.bucketName,
181200
buckets: [
182201
{
183-
aws_region: "<region>",
184-
bucket_name: "<bucket-name>",
185-
name: "<bucket-name>",
202+
aws_region: customBucket.env.region,
203+
bucket_name: customBucket.bucketName,
204+
name: customBucket.bucketName,
186205
paths: {
187206
"public/*": {
207+
guest: ["get", "list"],
188208
// highlight-start
189-
// "write" and "delete" can also be added depending on your use case
190-
guest: ["get", "list"],
191-
// highlight-end
192209
authenticated: ["get", "list", "write", "delete"],
210+
// highlight-end
193211
},
194212
},
195213
}
196214
]
197215
},
198216
});
199217

200-
// ... Authenticated user policy and role attachment goes here ...
218+
// ... Unauthenticated/guest user policies and role attachments go here ...
201219
// highlight-start
202220
/*
203-
Define an inline policy to attach to Amplify's un-auth role
204-
This policy defines how unauthenticated/guest users can access your existing bucket
221+
Define an inline policy to attach to Amplify's auth role
222+
This policy defines how authenticated users can access your existing bucket
205223
*/
206-
const unauthPolicy = new Policy(backend.stack, "customBucketUnauthPolicy", {
224+
const authPolicy = new Policy(backend.stack, "customBucketAuthPolicy", {
207225
statements: [
208226
new PolicyStatement({
209227
effect: Effect.ALLOW,
210-
actions: ["s3:GetObject"],
211-
resources: ["arn:aws:s3:::<bucket-name>/public/*"],
228+
actions: [
229+
"s3:GetObject",
230+
"s3:PutObject",
231+
"s3:DeleteObject"
232+
],
233+
resources: [`${customBucket.bucketArn}/public/*`,],
212234
}),
213235
new PolicyStatement({
214236
effect: Effect.ALLOW,
215237
actions: ["s3:ListBucket"],
216238
resources: [
217-
"arn:aws:s3:::<bucket-name>",
218-
"arn:aws:s3:::<bucket-name>/*"
219-
],
239+
`${customBucket.bucketArn}`,
240+
`${customBucket.bucketArn}/*`
241+
],
220242
conditions: {
221243
StringLike: {
222-
"s3:prefix": ["public/", "public/*"],
244+
"s3:prefix": ["public/*", "public/"],
223245
},
224246
},
225247
}),
226248
],
227249
});
228250

229-
// Add the policies to the unauthenticated user role
230-
backend.auth.resources.unauthenticatedUserIamRole.attachInlinePolicy(
231-
unauthPolicy,
232-
);
251+
// Add the policies to the authenticated user role
252+
backend.auth.resources.authenticatedUserIamRole.attachInlinePolicy(authPolicy);
233253
// highlight-end
234254
```
235255
</Block>
236256
<Block name="User Groups">
237257
Below is an example of expanding the original backend object to have an `admin/` folder that authenticated users can read, but only users belonging to the "admin" user group can manage:
238258
{/* cSpell:disable */}
239259
```ts title="amplify/backend.ts"
240-
import { defineBackend } from "@aws-amplify/backend";
241-
import { auth } from "./auth/resource";
260+
import { defineBackend } from '@aws-amplify/backend';
261+
import { Effect, Policy, PolicyStatement } from 'aws-cdk-lib/aws-iam';
262+
import { Bucket } from 'aws-cdk-lib/aws-s3';
263+
import { auth } from './auth/resource';
242264

243265
const backend = defineBackend({
244266
auth,
245267
});
246268

269+
const customBucketStack = backend.createStack("custom-bucket-stack");
270+
271+
// Import existing bucket
272+
const customBucket = Bucket.fromBucketAttributes(bucketStack, "MyCustomBucket", {
273+
bucketArn: "arn:aws:s3:::<bucket-name>",
274+
region: "<region>"
275+
});
276+
247277
backend.addOutput({
248278
storage: {
249-
aws_region: "<region>",
250-
bucket_name: "<bucket-name>",
279+
aws_region: customBucket.env.region,
280+
bucket_name: customBucket.bucketName,
251281
buckets: [
252282
{
253-
aws_region: "<region>",
254-
bucket_name: "<bucket-name>",
255-
name: "<bucket-name>",
283+
aws_region: customBucket.env.region,
284+
bucket_name: customBucket.bucketName,
285+
name: customBucket.bucketName,
256286
/*
257287
@ts-expect-error: Amplify backend type issue
258288
https://github.com/aws-amplify/amplify-backend/issues/2569
@@ -289,14 +319,14 @@ const adminPolicy = new Policy(backend.stack, "customBucketAdminPolicy", {
289319
"s3:PutObject",
290320
"s3:DeleteObject"
291321
],
292-
resources: ["arn:aws:s3:::<bucket-name>/admin/*"],
322+
resources: [ `${customBucket.bucketArn}/admin/*`],
293323
}),
294324
new PolicyStatement({
295325
effect: Effect.ALLOW,
296326
actions: ["s3:ListBucket"],
297327
resources: [
298-
"arn:aws:s3:::<bucket-name>",
299-
"arn:aws:s3:::<bucket-name>/*",
328+
`${customBucket.bucketArn}`
329+
`${customBucket.bucketArn}/*`
300330
],
301331
conditions: {
302332
StringLike: {
@@ -320,22 +350,32 @@ Below is an example of expanding the original backend object to define read acce
320350

321351
{/* cSpell:disable */}
322352
```ts title="amplify/backend.ts"
323-
import { defineBackend } from "@aws-amplify/backend";
353+
import { defineBackend } from '@aws-amplify/backend';
354+
import { Effect, Policy, PolicyStatement } from 'aws-cdk-lib/aws-iam';
355+
import { Bucket } from 'aws-cdk-lib/aws-s3';
324356
import { auth } from "./auth/resource";
325357

326358
const backend = defineBackend({
327359
auth,
328360
});
329361

362+
const customBucketStack = backend.createStack("custom-bucket-stack");
363+
364+
// Import existing bucket
365+
const customBucket = s3.Bucket.fromBucketAttributes(bucketStack, "MyCustomBucket", {
366+
bucketArn: "arn:aws:s3:::<bucket-name>",
367+
region: "<region>"
368+
});
369+
330370
backend.addOutput({
331371
storage: {
332-
aws_region: "<region>",
333-
bucket_name: "<bucket-name>",
372+
aws_region: customBucket.env.region,
373+
bucket_name: customBucket.bucketName,
334374
buckets: [
335375
{
336-
aws_region: "<region>",
337-
bucket_name: "<bucket-name>",
338-
name: "<bucket-name>",
376+
aws_region: customBucket.env.region,
377+
bucket_name: customBucket.bucketName,
378+
name: customBucket.bucketName,
339379
/*
340380
@ts-expect-error: Amplify backend type issue
341381
https://github.com/aws-amplify/amplify-backend/issues/2569
@@ -361,11 +401,9 @@ backend.addOutput({
361401
]
362402
},
363403
});
364-
365404
// highlight-start
366-
367405
/*
368-
Define an inline policy to attach to Amplify's un-auth role
406+
Define an inline policy to attach to Amplify's unauth role
369407
This policy defines how unauthenticated users/guests
370408
can access your existing bucket
371409
*/
@@ -375,16 +413,16 @@ const unauthPolicy = new Policy(backend.stack, "customBucketUnauthPolicy", {
375413
effect: Effect.ALLOW,
376414
actions: ["s3:GetObject"],
377415
resources: [
378-
"arn:aws:s3:::<bucket-name>/public/*",
379-
"arn:aws:s3:::<bucket-name>/protected/*"
416+
`${customBucket.bucketArn}/public/*`
417+
`${customBucket.bucketArn}/protected/*`
380418
],
381419
}),
382420
new PolicyStatement({
383421
effect: Effect.ALLOW,
384422
actions: ["s3:ListBucket"],
385423
resources: [
386-
"arn:aws:s3:::<bucket-name>",
387-
"arn:aws:s3:::<bucket-name>/*"
424+
`${customBucket.bucketArn}`
425+
`${customBucket.bucketArn}/*`
388426
],
389427
conditions: {
390428
StringLike: {
@@ -411,16 +449,16 @@ const authPolicy = new Policy(backend.stack, "customBucketAuthPolicy", {
411449
effect: Effect.ALLOW,
412450
actions: ["s3:GetObject"],
413451
resources: [
414-
"arn:aws:s3:::<bucket-name>/public/*",
415-
"arn:aws:s3:::<bucket-name>/protected/*"
452+
`${customBucket.bucketArn}/public/*`
453+
`${customBucket.bucketArn}/protected/*`
416454
],
417455
}),
418456
new PolicyStatement({
419457
effect: Effect.ALLOW,
420458
actions: ["s3:ListBucket"],
421459
resources: [
422-
"arn:aws:s3:::<bucket-name>",
423-
"arn:aws:s3:::<bucket-name>/*"
460+
`${customBucket.bucketArn}`
461+
`${customBucket.bucketArn}/*`
424462
],
425463
conditions: {
426464
StringLike: {
@@ -437,15 +475,15 @@ const authPolicy = new Policy(backend.stack, "customBucketAuthPolicy", {
437475
effect: Effect.ALLOW,
438476
actions: ["s3:PutObject"],
439477
resources: [
440-
"arn:aws:s3:::<bucket-name>/public/*",
441-
"arn:aws:s3:::<bucket-name>/protected/${cognito-identity.amazonaws.com:sub}/*"
478+
`${customBucket.bucketArn}/public/*`
479+
`${customBucket.bucketArn}/protected/${cognito-identity.amazonaws.com:sub}/*`
442480
],
443481
}),
444482
new PolicyStatement({
445483
effect: Effect.ALLOW,
446484
actions: ["s3:DeleteObject"],
447485
resources: [
448-
"arn:aws:s3:::<bucket-name>/protected/${cognito-identity.amazonaws.com:sub}/*"
486+
`${customBucket.bucketArn}/protected/${cognito-identity.amazonaws.com:sub}/*`
449487
],
450488
}),
451489
],

0 commit comments

Comments
 (0)