Protecting Applications with Lambda@Edge and OAuth
Download as PPTX, PDF0 likes416 views
The document discusses solutions to maintain environment consistency in cloud applications using Lambda@Edge, highlighting issues with protecting API endpoints. It outlines two primary problems: inconsistent architectures between environments and the need for secure API access without using traditional authentication methods. Various solutions are proposed, including leveraging internal VPC structures and OAuth for secure communications.
Protecting Applications with Lambda@Edge and OAuth
- 2. Allan Denot ➔ 5 years working as DevOps and AWS ➔ Senior DevOps Engineer at amaysim ➔ Master in IT from University of Sydney ➔ Former Ansible “expert” ➔ Currently doing Docker, ECS, CI/CD and Serverless @denot allandenot.com
- 4. Problem #1
- 5. Environment Consistency (or lack thereof)
- 6. Environment Consistency (or lack thereof) Engineer Before Internal VPC Dev QA VPN Stakeholders? Mobile? Architecture not consistent with Production
- 7. Internal VPC Environment Consistency (or lack thereof) CloudFront Dev QA VPN Production CloudFrontCloudFrontCan’t be exposed to public
- 8. Environment Consistency Solution #1 Internal VPC CloudFront Dev QA VPN Production CloudFrontCloudFront with Lambda with Lambda
- 9. Problem #2 (caused by Solution #1)
- 11. Protected API Endpoints Internal VPC QA CloudFront with Lambda API call 302 Redirect to OAuth Automate d test client Automate d test client
- 12. Protected API Endpoints Requirements ➔ Protected from public ➔ Can’t use API Tokens or header authentication - keep consistency with production ➔ Known sources should have direct access
- 13. Solution #2 Protected API Endpoints Internal VPC QA CloudFront with Lambda API call 200 OK Automate d test client Dynamo DB Automate d test client
- 14. How it works
- 15. 302 Redirect to OAuth Endpoint Request CALLBACK_URL with client code 200 Allow and set cookie Stores IP 302 Redirect to CALLBACK_URL with client code Request Webpage Flow Client CloudFront Labda@Edge OAuth Provider Client Authenticates with OAuth Provider Can include multiple interactions Checks code is valid Dynamo DB Dynamo DBIP Exists?
- 16. Demo
- 17. Questions? Links github.com/amaysim-au/cloudfront-auth-whitelist branches: github and azure Original code: github.com/Widen/cloudfront-auth