CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaaws-sdkamazon-iamaws-amplify
J. Hesters
J. Hesters

Reputation: 14748

How to run a Lambda function locally that accesses protected resources

I'm still learning to use AWS Lambda functions. I generated mine using the Amplify framework. The Lambda function I use needs to access an AppSync API. Therefore it has the following middleware:

const tapRoute = f => R.tap(route => route.use(f));

const hydrateClient = tapRoute(async function(req, res, next) {
  try {
    const url = process.env.API_SAYMAPPSYNCAPI_GRAPHQLAPIENDPOINTOUTPUT;
    const region = process.env.REGION;
    AWS.config.update({
      region,
      credentials: new AWS.Credentials(
        process.env.AWS_ACCESS_KEY_ID,
        process.env.AWS_SECRET_ACCESS_KEY,
        process.env.AWS_SESSION_TOKEN
      ),
    });
    const credentials = AWS.config.credentials;
    const appsyncClient = new AWSAppSyncClient(
      {
        url,
        region,
        auth: {
          type: 'AWS_IAM',
          credentials,
        },
        disableOffline: true,
      },
      {
        defaultOptions: {
          query: {
            fetchPolicy: 'network-only',
            errorPolicy: 'all',
          },
        },
      }
    );
    const client = await appsyncClient.hydrated();
    req.client = client;
    next();
  } catch (error) {
    console.log(error);
    next(error);
  }
});

As you can see I need to access the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. When I run the function in the cloud, it automatically gets the values for these variables. How can I get them locally? Which access key do I need to use and how do I get its secret access key and the session token?

Upvotes: 0

Views: 956

Answers (1)

Thales Minussi
Thales Minussi

Reputation: 7215

You don't need to explicitly set them if you have configured the ~/.aws/credentials file`.

If you want to configure this file, the easiest way is to simply install the aws-cli and run aws configure. You will be prompted to enter a few values, including AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

If you don't have this file configured, then you can set these values in environment variables yourself.

You can get these values by going to AWS Console -> IAM -> Users -> Select your User -> Security Credentials -> Access Keys. Then you click on "Create Access Key" and either download or write those values down, as AWS_SECRET_ACCESS_KEY is only visible during creation time. AWS_ACCESS_KEY_ID on the other hand is always visible, but it's quite useless if you don't have the secret.

AWS_SESSION_TOKEN is only required if the user in question is using MFA. If not, this value can be ignored.

< MFAOnly >

If you are using MFA though, you will need to use the aws-cli to fetch this value, like so:

aws sts get-session-token --serial-number arn:aws:iam::account-id-number:mfa/your-user --token-code MFAToken

Then, to set the temporary credentials, run aws configure again, replace the values of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY with the new temporary values.

Finally, to set AWS_SESSION_TOKEN, run aws configure set aws_session_token VALUE_RETURNED_FROM_GET_SESSION_TOKEN_COMMAND

< / MFAOnly >

Keep in mind that when running in the Cloud, these credentials are not loaded as you stated. IAM roles are used instead.

Upvotes: 2

Related Questions