From 1adb9c01b0f20eb23b7569a37595017b44f4230d Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sat, 26 May 2018 22:21:23 +1200 Subject: [PATCH 1/6] Fixed typo. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index aa11fe670..1ff32cf7c 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ We are going to create a [note taking app](https://demo2.serverless-stack.com) f It is a single-page React app powered by a serverless CRUD API. We also cover how add user authentication and handle file uploads. -The entire guide is hosted on GitHub and we use [Discourse][Discourse] for our comments. With the help of the community we grow the guide accurate and keep it up to date. +The entire guide is hosted on GitHub and we use [Discourse][Discourse] for our comments. With the help of the community we ensure the guide is accurate and keep it up to date. ## Project Goals From 90a14129adf5eab01fce735bf0a093b2090bcf52 Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sun, 27 May 2018 11:15:36 +1200 Subject: [PATCH 2/6] Minor copy tweaks to What is IAM --- _chapters/what-is-iam.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/_chapters/what-is-iam.md b/_chapters/what-is-iam.md index bcbb5c0e1..246a89277 100644 --- a/_chapters/what-is-iam.md +++ b/_chapters/what-is-iam.md @@ -68,21 +68,21 @@ And here is a policy that grants more granular access, only allowing retrieval o } ``` -We are using S3 resources in the above examples. But a policy looks similar for any of the AWS services. It just depends on the resource ARN for `Resource` property. An ARN is an identifier for a resource in AWS and we'll look at it in more detail in the next chapter. We also add the corresponding service actions and condition context keys in `Action` and `Condition` property. You can find all the available AWS Service actions and condition context keys for use in IAM Policies [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actionsconditions.html). Aside from attaching a policy to a user, you can attach them to a role or a group. +We are using S3 resources in the above examples. But a policy looks similar for any of the AWS services. It just depends on the resource ARN described by the `Resource` property. An ARN (Amazon Resource Name) is an identifier for a resource in AWS and we'll look at it in more detail in the next chapter. We also add the corresponding service actions and condition context keys in the `Action` and `Condition` properties. You can find all the available AWS Service actions and condition context keys for use in IAM Policies [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actionsconditions.html). Aside from attaching a policy to a user, you can also attach them to a role or a group. ### What is an IAM Role -Sometimes your AWS resources need to access other resources in your account. For example, you have a Lambda function that queries your DynamoDB to retrieve some data, process it, and then send Bob an email with the results. In this case, we want Lambda to only be able to make read queries so it does not change the database by mistake. We also want to restrict Lambda to be able to email Bob so it does not spam other people. This can be done by creating an IAM user and putting the user’s credentials to the Lambda function or embed the credentials in the Lambda code. But this is just not secure. If somebody was to get hold of these credentials, they could make those calls on your behalf. This is where IAM role comes in to play. +Sometimes your AWS resources need to access other resources in your account. For example, you have a Lambda function that queries your DynamoDB to retrieve some data, process it, and then send Bob an email with the results. In this case, we want Lambda to only be able to make read queries so it does not change the database by mistake. We also want to restrict Lambda to be able to email Bob so it does not spam other people. This can be done by creating an IAM user and assigning the user’s credentials to the Lambda function, or embedding the credentials in the Lambda code. But this is not secure – if somebody was to get hold of these credentials, they could make those calls on your behalf. This is where IAM roles come in to play. -An IAM role is very similar to a user, in that it is an *identity* with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it. Instead of being uniquely associated with one person, a role can be taken on by anyone who needs it. In this case, the Lambda function will be assigned with a role to temporarily take on the permission. +An IAM role is very similar to a user, in that it is an *identity* with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it. Instead of being uniquely associated with one person, a role can be taken on by anyone (or any service) requiring it. In this case, the Lambda function will be assigned a role allowing it to temporarily take on the desired permissions. ![AWS service with IAM Role diagram](/assets/iam/service-as-iam-role.png) -Roles can be applied to users as well. In this case, the user is taking on the policy set for the IAM role. This is useful for cases where a user is wearing multiple "hats" in the organization. Roles make this easy since you only need to create these roles once and they can be re-used for anybody else that wants to take it on. +Roles can be applied to users as well. In this case, the user is taking on the policy set for the IAM role. This is useful for cases where a user is wearing multiple "hats" in the organization. Roles make this easy since you only need to create each role once; they can then be re-used by anyone else who needs to take those permissions on. ![IAM User with IAM Role diagram](/assets/iam/iam-user-as-iam-role.png) -You can also have a role tied to the ARN of a user from a different organization. This allows the external user to assume that role as a part of your organization. This is typically used when you have a third party service that is acting on your AWS Organization. You'll be asked to create a Cross-Account IAM Role and add the external user as a *Trust Relationship*. The *Trust Relationship* is telling AWS that the specified external user can assume this role. +You can also have a role tied to the ARN of a user from a different organization. This allows the external user to assume that role as a part of your organization. This is typically used when you have a third party service that is acting on your AWS Organization. You'll be asked to create a Cross-Account IAM Role and add the external user as a *Trust Relationship*. The *Trust Relationship* tells AWS that the specified external user can assume this role. ![External IAM User with IAM Role diagram](/assets/iam/external-user-with-iam-role.png) @@ -93,4 +93,4 @@ An IAM group is simply a collection of IAM users. You can use groups to specify ![Complete IAM Group, IAM Role, IAM User, and IAM Policy diagram](/assets/iam/complete-iam-concepts.png) -This should give you a quick idea of IAM and some of its concepts. We will be referring to a few of these in the coming chapters. Next let's quickly look at another AWS concept; the ARN. +This should give you a quick idea of IAM and some of its concepts. We will be referring to a few of these in the coming chapters. Next let's quickly look at another AWS concept: the ARN. From 006562e19dd7b7103661fed49a7e31125556397d Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sun, 27 May 2018 11:21:49 +1200 Subject: [PATCH 3/6] Minor copy tweaks to What Is An ARN --- _chapters/what-is-an-arn.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/_chapters/what-is-an-arn.md b/_chapters/what-is-an-arn.md index b99a0a2d2..1ee09a2cc 100644 --- a/_chapters/what-is-an-arn.md +++ b/_chapters/what-is-an-arn.md @@ -7,13 +7,13 @@ context: true comments_id: what-is-an-arn/34 --- -In the last chapter while we were looking at IAM policies we looked at how you can specify a resource using its ARN. Let's take a better look at what ARN is. +In the last chapter while we were looking at IAM policies we looked at how you can specify a resource using its ARN. Let's take a closer look at what an ARN is. Here is the official definition: > Amazon Resource Names (ARNs) uniquely identify AWS resources. We require an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls. -ARN is really just a globally unique identifier for an individual AWS resource. It takes one of the following formats. +An ARN is really just a globally unique identifier for an individual AWS resource. It takes one of the following formats. ``` arn:partition:service:region:account-id:resource @@ -21,7 +21,7 @@ arn:partition:service:region:account-id:resourcetype/resource arn:partition:service:region:account-id:resourcetype:resource ``` -Let's look at some examples of ARN. Note the different formats used. +Let's look at some examples of ARNs. Note the different formats used. ``` @@ -37,11 +37,11 @@ arn:aws:rds:eu-west-1:123456789012:db:mysql-db arn:aws:s3:::my_corporate_bucket/exampleobject.png ``` -Finally, let's look at the common use cases for ARN. +Finally, let's look at the common use cases for ARNs. 1. Communication - ARN is used to reference a specific resource when you orchestrate a system involving multiple AWS resources. For example, you have an API Gateway listening for RESTful APIs and invoking the corresponding Lambda function based on the API path and request method. The routing looks like the following. + An ARN is used to reference a specific resource when you orchestrate a system involving multiple AWS resources. For example, when you have an API Gateway listening for RESTful APIs and invoking the corresponding Lambda function based on the API path and request method. The routing looks like the following. ``` GET /hello_world => arn:aws:lambda:us-east-1:123456789012:function:lambda-hello-world @@ -49,7 +49,7 @@ Finally, let's look at the common use cases for ARN. 2. IAM Policy - We had looked at this in detail in the last chapter but here is an example of a policy definition. + We looked at this in detail in the last chapter but here is an example of a policy definition. ``` json { @@ -61,6 +61,6 @@ Finally, let's look at the common use cases for ARN. } ``` - ARN is used to define which resource (S3 bucket in this case) the access is granted for. The wildcard `*` character is used here to match all resources inside the *Hello-bucket*. + An ARN is used to define which resource (an S3 bucket in this case) access is granted for. The wildcard `*` character is used here to match all resources inside the *Hello-bucket*. Next let's configure our AWS CLI. We'll be using the info from the IAM user account we created previously. From 07aa267cd8f32301344a40eae198a1fc826e0ee0 Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sun, 27 May 2018 11:25:53 +1200 Subject: [PATCH 4/6] Minor tweaks to Configure the AWS CLI --- _chapters/configure-the-aws-cli.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_chapters/configure-the-aws-cli.md b/_chapters/configure-the-aws-cli.md index c4585aec6..18ce93216 100644 --- a/_chapters/configure-the-aws-cli.md +++ b/_chapters/configure-the-aws-cli.md @@ -7,7 +7,7 @@ context: true comments_id: configure-the-aws-cli/86 --- -To make it easier to work with a lot of the AWS services, we are going to use the [AWS CLI](https://aws.amazon.com/cli/). +To make it easier to work with a lot of AWS services, we are going to use the [AWS CLI](https://aws.amazon.com/cli/). ### Install the AWS CLI @@ -22,7 +22,7 @@ AWS CLI needs Python 2 version 2.6.5+ or Python 3 version 3.3+ and [Pip](https:/ $ sudo pip install awscli ``` -If you are having some problems installing the AWS CLI or need Windows install instructions, refer to the [complete install instructions](http://docs.aws.amazon.com/cli/latest/userguide/installing.html). +If you are having problems installing the AWS CLI or need Windows install instructions, refer to the [complete install instructions](http://docs.aws.amazon.com/cli/latest/userguide/installing.html). ### Add Your Access Key to AWS CLI From 36eaaddb3740ff1f92378eadb982851271bac09c Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sun, 27 May 2018 12:11:28 +1200 Subject: [PATCH 5/6] Revert "Minor tweaks to Set Up Your AWS Account" --- _chapters/configure-the-aws-cli.md | 4 ++-- _chapters/what-is-an-arn.md | 14 +++++++------- _chapters/what-is-iam.md | 12 ++++++------ 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/_chapters/configure-the-aws-cli.md b/_chapters/configure-the-aws-cli.md index 18ce93216..c4585aec6 100644 --- a/_chapters/configure-the-aws-cli.md +++ b/_chapters/configure-the-aws-cli.md @@ -7,7 +7,7 @@ context: true comments_id: configure-the-aws-cli/86 --- -To make it easier to work with a lot of AWS services, we are going to use the [AWS CLI](https://aws.amazon.com/cli/). +To make it easier to work with a lot of the AWS services, we are going to use the [AWS CLI](https://aws.amazon.com/cli/). ### Install the AWS CLI @@ -22,7 +22,7 @@ AWS CLI needs Python 2 version 2.6.5+ or Python 3 version 3.3+ and [Pip](https:/ $ sudo pip install awscli ``` -If you are having problems installing the AWS CLI or need Windows install instructions, refer to the [complete install instructions](http://docs.aws.amazon.com/cli/latest/userguide/installing.html). +If you are having some problems installing the AWS CLI or need Windows install instructions, refer to the [complete install instructions](http://docs.aws.amazon.com/cli/latest/userguide/installing.html). ### Add Your Access Key to AWS CLI diff --git a/_chapters/what-is-an-arn.md b/_chapters/what-is-an-arn.md index 1ee09a2cc..b99a0a2d2 100644 --- a/_chapters/what-is-an-arn.md +++ b/_chapters/what-is-an-arn.md @@ -7,13 +7,13 @@ context: true comments_id: what-is-an-arn/34 --- -In the last chapter while we were looking at IAM policies we looked at how you can specify a resource using its ARN. Let's take a closer look at what an ARN is. +In the last chapter while we were looking at IAM policies we looked at how you can specify a resource using its ARN. Let's take a better look at what ARN is. Here is the official definition: > Amazon Resource Names (ARNs) uniquely identify AWS resources. We require an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls. -An ARN is really just a globally unique identifier for an individual AWS resource. It takes one of the following formats. +ARN is really just a globally unique identifier for an individual AWS resource. It takes one of the following formats. ``` arn:partition:service:region:account-id:resource @@ -21,7 +21,7 @@ arn:partition:service:region:account-id:resourcetype/resource arn:partition:service:region:account-id:resourcetype:resource ``` -Let's look at some examples of ARNs. Note the different formats used. +Let's look at some examples of ARN. Note the different formats used. ``` @@ -37,11 +37,11 @@ arn:aws:rds:eu-west-1:123456789012:db:mysql-db arn:aws:s3:::my_corporate_bucket/exampleobject.png ``` -Finally, let's look at the common use cases for ARNs. +Finally, let's look at the common use cases for ARN. 1. Communication - An ARN is used to reference a specific resource when you orchestrate a system involving multiple AWS resources. For example, when you have an API Gateway listening for RESTful APIs and invoking the corresponding Lambda function based on the API path and request method. The routing looks like the following. + ARN is used to reference a specific resource when you orchestrate a system involving multiple AWS resources. For example, you have an API Gateway listening for RESTful APIs and invoking the corresponding Lambda function based on the API path and request method. The routing looks like the following. ``` GET /hello_world => arn:aws:lambda:us-east-1:123456789012:function:lambda-hello-world @@ -49,7 +49,7 @@ Finally, let's look at the common use cases for ARNs. 2. IAM Policy - We looked at this in detail in the last chapter but here is an example of a policy definition. + We had looked at this in detail in the last chapter but here is an example of a policy definition. ``` json { @@ -61,6 +61,6 @@ Finally, let's look at the common use cases for ARNs. } ``` - An ARN is used to define which resource (an S3 bucket in this case) access is granted for. The wildcard `*` character is used here to match all resources inside the *Hello-bucket*. + ARN is used to define which resource (S3 bucket in this case) the access is granted for. The wildcard `*` character is used here to match all resources inside the *Hello-bucket*. Next let's configure our AWS CLI. We'll be using the info from the IAM user account we created previously. diff --git a/_chapters/what-is-iam.md b/_chapters/what-is-iam.md index 246a89277..bcbb5c0e1 100644 --- a/_chapters/what-is-iam.md +++ b/_chapters/what-is-iam.md @@ -68,21 +68,21 @@ And here is a policy that grants more granular access, only allowing retrieval o } ``` -We are using S3 resources in the above examples. But a policy looks similar for any of the AWS services. It just depends on the resource ARN described by the `Resource` property. An ARN (Amazon Resource Name) is an identifier for a resource in AWS and we'll look at it in more detail in the next chapter. We also add the corresponding service actions and condition context keys in the `Action` and `Condition` properties. You can find all the available AWS Service actions and condition context keys for use in IAM Policies [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actionsconditions.html). Aside from attaching a policy to a user, you can also attach them to a role or a group. +We are using S3 resources in the above examples. But a policy looks similar for any of the AWS services. It just depends on the resource ARN for `Resource` property. An ARN is an identifier for a resource in AWS and we'll look at it in more detail in the next chapter. We also add the corresponding service actions and condition context keys in `Action` and `Condition` property. You can find all the available AWS Service actions and condition context keys for use in IAM Policies [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actionsconditions.html). Aside from attaching a policy to a user, you can attach them to a role or a group. ### What is an IAM Role -Sometimes your AWS resources need to access other resources in your account. For example, you have a Lambda function that queries your DynamoDB to retrieve some data, process it, and then send Bob an email with the results. In this case, we want Lambda to only be able to make read queries so it does not change the database by mistake. We also want to restrict Lambda to be able to email Bob so it does not spam other people. This can be done by creating an IAM user and assigning the user’s credentials to the Lambda function, or embedding the credentials in the Lambda code. But this is not secure – if somebody was to get hold of these credentials, they could make those calls on your behalf. This is where IAM roles come in to play. +Sometimes your AWS resources need to access other resources in your account. For example, you have a Lambda function that queries your DynamoDB to retrieve some data, process it, and then send Bob an email with the results. In this case, we want Lambda to only be able to make read queries so it does not change the database by mistake. We also want to restrict Lambda to be able to email Bob so it does not spam other people. This can be done by creating an IAM user and putting the user’s credentials to the Lambda function or embed the credentials in the Lambda code. But this is just not secure. If somebody was to get hold of these credentials, they could make those calls on your behalf. This is where IAM role comes in to play. -An IAM role is very similar to a user, in that it is an *identity* with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it. Instead of being uniquely associated with one person, a role can be taken on by anyone (or any service) requiring it. In this case, the Lambda function will be assigned a role allowing it to temporarily take on the desired permissions. +An IAM role is very similar to a user, in that it is an *identity* with permission policies that determine what the identity can and cannot do in AWS. However, a role does not have any credentials (password or access keys) associated with it. Instead of being uniquely associated with one person, a role can be taken on by anyone who needs it. In this case, the Lambda function will be assigned with a role to temporarily take on the permission. ![AWS service with IAM Role diagram](/assets/iam/service-as-iam-role.png) -Roles can be applied to users as well. In this case, the user is taking on the policy set for the IAM role. This is useful for cases where a user is wearing multiple "hats" in the organization. Roles make this easy since you only need to create each role once; they can then be re-used by anyone else who needs to take those permissions on. +Roles can be applied to users as well. In this case, the user is taking on the policy set for the IAM role. This is useful for cases where a user is wearing multiple "hats" in the organization. Roles make this easy since you only need to create these roles once and they can be re-used for anybody else that wants to take it on. ![IAM User with IAM Role diagram](/assets/iam/iam-user-as-iam-role.png) -You can also have a role tied to the ARN of a user from a different organization. This allows the external user to assume that role as a part of your organization. This is typically used when you have a third party service that is acting on your AWS Organization. You'll be asked to create a Cross-Account IAM Role and add the external user as a *Trust Relationship*. The *Trust Relationship* tells AWS that the specified external user can assume this role. +You can also have a role tied to the ARN of a user from a different organization. This allows the external user to assume that role as a part of your organization. This is typically used when you have a third party service that is acting on your AWS Organization. You'll be asked to create a Cross-Account IAM Role and add the external user as a *Trust Relationship*. The *Trust Relationship* is telling AWS that the specified external user can assume this role. ![External IAM User with IAM Role diagram](/assets/iam/external-user-with-iam-role.png) @@ -93,4 +93,4 @@ An IAM group is simply a collection of IAM users. You can use groups to specify ![Complete IAM Group, IAM Role, IAM User, and IAM Policy diagram](/assets/iam/complete-iam-concepts.png) -This should give you a quick idea of IAM and some of its concepts. We will be referring to a few of these in the coming chapters. Next let's quickly look at another AWS concept: the ARN. +This should give you a quick idea of IAM and some of its concepts. We will be referring to a few of these in the coming chapters. Next let's quickly look at another AWS concept; the ARN. From 6cf25757105c5cae0c47f73ed2a087706ea2588e Mon Sep 17 00:00:00 2001 From: James McGlinn Date: Sun, 27 May 2018 12:11:57 +1200 Subject: [PATCH 6/6] Revert "Fixed typo" --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1ff32cf7c..aa11fe670 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ We are going to create a [note taking app](https://demo2.serverless-stack.com) f It is a single-page React app powered by a serverless CRUD API. We also cover how add user authentication and handle file uploads. -The entire guide is hosted on GitHub and we use [Discourse][Discourse] for our comments. With the help of the community we ensure the guide is accurate and keep it up to date. +The entire guide is hosted on GitHub and we use [Discourse][Discourse] for our comments. With the help of the community we grow the guide accurate and keep it up to date. ## Project Goals