如何使用AWS Web API和Lambda对无服务器Web请求进行身份验证?

TL; DR解决方案:创建一个Cognito身份池，分配策略用户只能上传以其ID为前缀的文件.

TL;DR Solution: create a Cognito Identity Pool, assign policy users can only upload files prefixed by their Identity ID.

如果我正确理解了您的问题，则希望设置一种方式来存储在S3上的图像可以公开查看，但只能由上传它的用户修改 >.实际上，您可以在浏览器中验证文件所有权，旋转图像并将旋转的图像上传到S3，而无需通过Lambda函数.

If I understand your question correctly, you want to setup a way for an image stored on S3 to be viewable by public, yet only editable by the user who uploaded it. Actually, you can verify file ownership, rotate the image and upload the rotated image to S3 all in the browser without going through a Lambda function.

第1步:创建Cognito用户池以创建用户目录.如果您已经具有用户登录/注册身份验证系统，则可以跳过此步骤.

Step 1: Create a Cognito User Pool to create a user directory. If you already have a user login/sign up authentication system, you could skip this step.

第2步:创建一个Cognito身份池以启用联盟身份，以便您的用户可以从身份池中获得临时的AWS凭证，并使用它将文件上传到S3，而无需通过服务器/lambda.

Step 2: Create a Cognito Identify Pool to enable federated identity, so your users can get a temporary AWS credential from the Identity Pool, and use it to upload files to S3 without going through your server/lambda.

步骤3:创建Cognito身份池时，您可以定义有关允许用户访问哪些S3资源的策略.这是示例政策

Step 3: When creating the Cognito Identity Pool, you can define a policy on what S3 resources a user is allowed to access. Here is a sample policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mobileanalytics:PutEvents",
        "cognito-sync:*",
        "cognito-identity:*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_S3_UPLOADS_BUCKET_NAME/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_S3_UPLOADS_BUCKET_NAME/${cognito-identity.amazonaws.com:sub}*"
      ]
    }
  ]
}

请注意，第二个块将"S3:GetObject"分配给S3存储桶中的所有文件；第三个块将"S3:PutObject"分配给仅以用户的Cognito身份ID为前缀的文件.

Note the second block assigns "S3:GetObject" to all files in your S3 bucket; and the third block assigns "S3:PutObject" to ONLY FILES prefixed with the user's Cognito Identity ID.

第4步:在前端JS中，从Cognito身份池中获取临时证书

Step 4: In frontend JS, get a temporary credential from Cognito Identity Pool

export function getAwsCredentials(userToken) {
  const authenticator = `cognito-idp.${config.cognito.REGION}.amazonaws.com/${config.cognito.USER_POOL_ID}`;

  AWS.config.update({ region: config.cognito.REGION });

  AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: config.cognito.IDENTITY_POOL_ID,
    Logins: {
      [authenticator]: userToken
    }
  });

  return new Promise((resolve, reject) => (
    AWS.config.credentials.get((err) => {
      if (err) {
        reject(err);
        return;
      }

      resolve();
    })
  ));
}

第5步:使用凭据将文件上传到S3，并在文件名前添加用户的Cognito身份ID.

Step 5: Upload files to S3 with the credential, prefix the file name with the user's Cognito Identity ID.

export async function s3Upload(file, userToken) {
  await getAwsCredentials(userToken);

  const s3 = new AWS.S3({
    params: {
      Bucket: config.s3.BUCKET,
    }
  });
  const filename = `${AWS.config.credentials.identityId}-${Date.now()}-${file.name}`;

  return new Promise((resolve, reject) => (
    s3.putObject({
      Key: filename,
      Body: file,
      ContentType: file.type,
      ACL: 'public-read',
    },
    (error, result) => {
      if (error) {
        reject(error);
        return;
      }

      resolve(`${config.s3.DOMAIN}/${config.s3.BUCKET}/${filename}`);
    })
  ));
}