Okay now before we get in and start creating our federated identity pool, we 1
need to actually create our website, and we'll create a bucket for our website 2
because we're going to need that bucket name in an IAM role that we need for this 3
federated identity pool, so we just goining to go into the s3 management console 4
creating a bucket, just going to give that bucket a name and just click on 5
next, I'm racing through this very quickly because we've we already know 6
how to do this, so next again, make sure that we have public access on this 7
bucket so public read access, next create bucket so once that bucket has been 8
created we just go into it and the first thing we need to do is change the 9
permissions on that bucket, so we need to have cross-origin resource sharing 10
enabled on this and we need have a policy set up for that, the reason being 11
is that our application is going to be on the browser side and it will be 12
accessing multiple domains through that browser so the browser will block that 13
from occurring unless cause is set up, so we click on 14
CORS and there is already a sample policy there, we're not going to use that 15
one, I'm going to use one that I prepared earlier 16
okay so just copied and pasted that over from the lab notes so we can see there 17
we've got "get, put, post, delete", all that is going to be allowed for 18
cross-origin resource sharing on this bucket, once we've done that we need to 19
go in and upload our website, so we need to first off there's a link for the 20
BackSpace Academy repository on github for this code, so you just go to that and 21
clone that or download it or if you'd like to work on it and send me some pull 22
requests and tidy it up a little bit and make it look a bit more 23
pretty for me you can always fork that and I'll take any any pull requests 24
quite happily for that, so clone that, download it and open that up into your 25
and into a folder somewhere and get that ready to upload 26
on to your bucket, so just going back in there we upload and we're just going to 27
drag and drop those files across 28
and again we make sure that that's public permissions so grant public read 29
access and will upload that 30
okay so our website is uploaded and all ready to go so we just don't need to go 31
into properties and enable static website hosting, again we know how to do 32
this, use this bucket to host a website, we're going to put in our index.html 33
file for that, and I'm just going to click on the endpoint to get that open 34
it won't work because we haven't enabled it yet, and click on save and go 35
back to the overview then I'm just going to refresh that URL for the website and 36
it should come in, so what's basically happened there is that there is a little 37
bit of a a spinner image that appeared there and that's going to be up when the 38
JavaScript SDK is coming into the browser when it's loading that 39
JavaScript SDK and I'll only do that once because after that will be stored 40
in in browser memory and while that's occurring these buttons will not be 41
visible and the reason I've done that is it because we don't want to click on any 42
of these buttons and have any any attempt at running code until that 43
JavaScript SDK has fully come in, so that's all we need to do for setting up 44
this website, so just going back into the github repository for it, so we've got an 45
index.html file there which is got all those buttons and whatever we're not 46
going to be doing anything with that with that file but what we're going to 47
do is, if you look at the js folder here, there will be an app.js and that 48
will be a starting point for our application, so I'll have some basic 49
stuff there for the user interface and we're going to build up the code that we 50
need for using Cognito but if you're lazy or you've got lost and it doesn't 51
work you, there is one here called app - final, so all you need to do is rename 52
that to .js and you can you can just write up without too many difficulties 53
you'll just have to go in there and change obviously your user pool ID your 54
client ID, your identity pool ID your bucket name all this sort of stuff 55
will need to be changed as well otherwise it won't work of 56
course. Okay so that's all we need to do now for that and what we'll do now is 57
we'll create this identity pool so we just go back into user pools and click 58
on at the top here we've got federated identities and it just jumps straight 59
into a getting started wizard, so I'm just going to give that a name, 60
okay so we've got an authenticated identities here, so we don't want to 61
allow unauthenticated identities for our application but we could if we wanted to 62
we could have that happen what we want to do is we want to use authentication 63
providers, now we're going to be using a Cognito user pool to authenticate our 64
users but we don't have to use Cognito we can use Amazon login with Amazon, 65
Facebook, Google, or any oauth process that we that we would like to use, we can also 66
use SAML if we've got an enterprise SAML application that we want to 67
integrate in with that we can do that with Cognito not a problem and we can 68
also have a custom one we can do our own custom oauth authentication service but 69
we're just going to use Cognito but you can use Cognito you don't have to use 70
Cognito and you can use all of these you can have login with Cognito, Amazon, 71
Facebook the whole lot of them, if you wanted to, so it's it's quite a powerful 72
service from that perspective so the first thing we need to do is put that 73
user pool ID, so we need to go back into the user pool, so we need to go back into 74
services and then back into the Cognito main console if I can find it there it is 75
okay manage your user pools and we'll get that user pool ID 76
which is this one here, so we want the pool ID we don't want the irn and we put 77
that in there we also need to grab that client ID of our application so we just 78
go into app clients and we'll grab that client ID we'll just copy that over and 79
that's what we need to do so that app client ID and user pool ID they're all 80
different and the the identity ID will be created after this, so that's going to, 81
click on create pool, ok so what's happening now is that we're now going to 82
be going to the IAM service because Cognito or Cognito ID needs to have 83
permission to access resources on your behalf, so we do that obviously for a 84
service through an I am role, now we have two roles here we have one for the 85
authenticated identities and another one for the unauthenticated identities, so 86
I'm just going to keep that just have a look at the policy name first so we're 87
not even allowing an or an authenticated so it doesn't really matter I'm just 88
going to just get rid of that change it to a different name 89
so it won't give me an error and I've already used this for awesome is going 90
to change this one to a different name as well now we need to view this policy 91
document so just edit it's going to come up with a little warning saying well 92
better read the documentation before you play with this, that's fine I'll just 93
expand that out of it so what we've got there is a policy that allows whatever 94
server set that assumes this role it allows to have access to mobile 95
analytics for put events to the Cognito sync service and Cognito identity 96
service, we want more than that because we want these temporary credentials to 97
be our two access Amazon s3 as well so we're going 98
to and that to that's are just going to copy that over from at the lab notes ok 99
so I've just copied and pasted that in there so you can see here we've got the 100
same permission that we had before we haven't changed that but we've added an 101
s3 service in here so allowing for we got to allows here the first one it's a 102
list buckets in a folder within our main bucket so you need to change this to the 103
name of your bucket so this one here is backspace-lab-copy, you need to change 104
that to the name of your bucket that you just created and what it does it allows 105
to list buckets within a folder called Cognito and then a subfolder of that 106
called backspace - Academy, we have another one here that has get put and 107
delete of objects within again within that bucket and then another subfolder 108
of that called Cognito and then another one called backspace Academy and then 109
another folder or subfolder of that which is going to be in the name of that 110
Cognito user or that the Cognito uses ID and so what that means is that that 111
person can upload or delete or change objects but they can only do that in a 112
folder that is specifically in there they're there a Cognito ID and they 113
cannot access any other part for delete or put or anything also on that bucket 114
so we just click on allow and that's all successful and it brings us back into 115
here with some sample codes so this is for android we can have a look at the 116
JavaScript code it just tells you how to create a table us credentials which is 117
what we've got there that's not going to be enough for a user to access but we'll 118
go into that later on but what we need to take note of here is this user pool 119
ID that's what we use to access or what we 120
use is with our authenticated service to access our temporary credentials so I'm 121
just going to go to the dashboard and there we can see that we have a 122
dashboard that shows how many identities are logging in and what are the 123
authentication methods so here we've got that user pool but we might have here a 124
Facebook authentication method and Google or whatever, so those who will be 125
listed up here and how often they're been accessed through those 126
different methods so now that we've done that we can look at getting stuck into 127
creating our a web application that has this Cognito power behind it