Package: cdk-private-asset-bucket
cdk-private-asset-bucketA construct to create a private asset S3 bucket. Cognito will be used for token validation with Lambda@Edge.ArchitectureCurious how I did the diagram? Have a look herehttps://martinmueller.dev/cdk-dia-eng.Exampleimport{PrivateAssetBucket}from'cdk-private-assets-bucket';...constuserPool=newcognito.UserPool(stack,'userPool',{removalPolicy:core.RemovalPolicy.DESTROY,});constuserPoolWebClient=newcognito.UserPoolClient(stack,'userPoolWebClient',{userPool:userPool,generateSecret:false,preventUserExistenceErrors:true,authFlows:{adminUserPassword:true,userPassword:true,},oAuth:{flows:{authorizationCodeGrant:false,implicitCodeGrant:true,},},});constprivateAssetBucket=newPrivateAssetBucket(stack,'privateAssetBucket',{userPoolId:userPool.userPoolId,userPoolClientId:userPoolWebClient.userPoolClientId,tokenUse:'access',});newcore.CfnOutput(stack,'AssetBucketName',{value:privateAssetBucket.assetBucketName,});newcore.CfnOutput(stack,'AssetBucketCloudfrontUrl',{value:privateAssetBucket.assetBucketCloudfrontUrl,});PropertiesAPI.mdTest PrivateBucketAssetIf you forged / cloned that repo you can test directly from here. Don't forget to init with:yarninstallCreate a test cdk stack with one of the following:yarncdkdeploy
yarncdkdeploy--watch
yarncdkdeploy--require-approvalneverUpload a picture named like pic.png to the private asset bucketCreate a user pool user and get / save the token:USER_POOL_ID=us-east-1_0Aw1oPvD6CLIENT_ID=3eqcgvghjbv4d5rv32hopmadu8USER_NAME=martindevUSER_PASSWORD=M@rtindev1REGION=us-east-1CFD=d1f2bfdek3mzi7.cloudfront.net

awscognito-idpadmin-create-user--user-pool-id$USER_POOL_ID--username$USER_NAME--region$REGIONawscognito-idpadmin-set-user-password--user-pool-id$USER_POOL_ID--username$USER_NAME--password$USER_PASSWORD--permanent--region$REGIONACCESS_TOKEN=$(awscognito-idpinitiate-auth--auth-flowUSER_PASSWORD_AUTH--client-id$CLIENT_ID--auth-parametersUSERNAME=$USER_NAME,PASSWORD=$USER_PASSWORD--region$REGION|jq-r'.AuthenticationResult.AccessToken')echo"curl --location --request GET "https://$CFD/pic.png" --cookie "Cookie:token=$ACCESS_TOKEN""You can use the curl for importing in Postman. but it looks like Postman can't import the cookie. So you need to set the cookie manually in Postman!In Postman you should see your picture :)For Debugging the Lambda@Edge with Cloudwatch go to the AWS Console --> Cloudwatch --> Log groups --> switch to the region you are closest to --> figure out which log group is correctPlanned FeaturesSupport custom authorizerLeverage Cloudfront Function for cheaper costsMiscThere is currently my aws-cdk PR open for importing the Typescript Lambda@Edge interfacehttps://github.com/aws/aws-cdk/pull/18836gittag-av2.16.0-m"prepare tag version"&&gitpush--tagsThanks ToCrespo Wang for his pioneer work regarding private S3 assetshttps://javascript.plainenglish.io/use-lambda-edge-jwt-to-secure-s3-bucket-dcca6eec4d7eAs always to the amazing CDK / Projen Community. Join us onSlack!Projenproject and the community around it.To you for checking this out. Check me out and perhaps give me feedbackhttps://martinmueller.dev.I love to work on Content Management Open Source projects. A lot from my stuff you can already use onhttps://github.com/mmuller88. If you like my work there and my blog posts, please consider supporting me on Patreon: