Skip to content

Commit b564c6d

Browse files
mnapolimnapoli
committed
Add a documentation page for AWS credentials
1 parent 44f0f4e commit b564c6d

File tree

4 files changed

+171
-5
lines changed

4 files changed

+171
-5
lines changed

‎docs/environment/_meta.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@
99
"database-public": {
1010
"display": "hidden"
1111
},
12+
"aws-credentials": "AWS credentials",
1213
"performances": "Performance"
1314
}

‎docs/environment/aws-credentials.mdx‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
import { NextSeo } from 'next-seo';
2+
import { Callout, Tabs } from 'nextra/components';
3+
4+
<NextSeo description="Access other AWS services from AWS Lambda by using the built-in AWS credentials." />
5+
6+
# AWS credentials on AWS Lambda
7+
8+
When your PHP application runs on AWS Lambda, it automatically has access to AWS credentials. This means you don't need to manage AWS access keys or credentials in your code - Lambda handles this for you.
9+
10+
<Callout type="warning">
11+
**Common mistake**: Don't put AWS access keys in your Lambda functions or environment variables. Lambda provides credentials automatically.
12+
</Callout>
13+
14+
## How it works
15+
16+
Lambda functions **automatically get AWS access keys** in their environment variables. These credentials are temporary and managed by AWS, so you don't have to worry about rotating them or keeping them secure.
17+
18+
```php
19+
echo $_SERVER['AWS_ACCESS_KEY_ID']; // AKIAIOSFODNN7EXAMPLE
20+
echo $_SERVER['AWS_SECRET_ACCESS_KEY']; // wJalrXUtnFEM
21+
echo $_SERVER['AWS_SESSION_TOKEN']; // AQoEXAMPLEH4aoAH0gNCAPy...
22+
```
23+
24+
The PHP AWS SDK automatically detects and uses them. Here's an example with S3:
25+
26+
```php
27+
$s3 = new \Aws\S3\S3Client([
28+
'version' => 'latest',
29+
'region' => $_SERVER['AWS_REGION'],
30+
// No credentials needed, the SDK uses the environment variables automatically
31+
]);
32+
33+
// Use S3 normally
34+
$result = $s3->putObject([
35+
'Bucket' => 'my-bucket',
36+
'Key' => 'file.txt',
37+
'Body' => 'Hello from Lambda!'
38+
]);
39+
40+
// Note that this also works with https://async-aws.com
41+
```
42+
43+
These credentials have access controlled by an IAM role defined in `serverless.yml`.
44+
45+
<Callout type="info">
46+
By default, Lambda functions **don't have any access** (principle of least privilege). To access other AWS services (like S3 or SQS), you need to add permissions to that IAM role in `serverless.yml` (read below).
47+
</Callout>
48+
49+
## Adding permissions
50+
51+
To grant your Lambda function access to AWS services, add IAM statements to your `serverless.yml`:
52+
53+
```yaml
54+
service: my-app
55+
56+
provider:
57+
name: aws
58+
iam:
59+
role:
60+
statements:
61+
# IAM statements here...
62+
63+
functions:
64+
# ...
65+
```
66+
67+
### Example: S3
68+
69+
To read and write files to an S3 bucket:
70+
71+
```yaml
72+
provider:
73+
name: aws
74+
iam:
75+
role:
76+
statements:
77+
# Allow Lambda to read and write to S3
78+
- Effect: Allow
79+
Action:
80+
- s3:GetObject
81+
- s3:PutObject
82+
- s3:DeleteObject
83+
Resource: arn:aws:s3:::my-bucket/*
84+
# Allow listing bucket contents
85+
- Effect: Allow
86+
Action: s3:ListBucket
87+
Resource: arn:aws:s3:::my-bucket
88+
```
89+
90+
<Callout>
91+
If you use the [Lift `storage` construct](./storage.mdx#s3-storage) to create S3 buckets, it [automatically adds the necessary permissions](https://github.com/getlift/lift/blob/master/docs/storage.md#permissions) to your functions. No need to set up permissions manually!
92+
</Callout>
93+
94+
### Example: SQS
95+
96+
To send and receive messages from SQS queues:
97+
98+
```yaml
99+
provider:
100+
name: aws
101+
iam:
102+
role:
103+
statements:
104+
# Allow Lambda to access an SQS queue
105+
- Effect: Allow
106+
Action:
107+
- sqs:SendMessage
108+
- sqs:ReceiveMessage
109+
- sqs:DeleteMessage
110+
- sqs:GetQueueAttributes
111+
Resource: arn:aws:sqs:${aws:region}:${aws:accountId}:my-queue
112+
```
113+
114+
<Callout>
115+
If you use the [Lift `queue` construct](../use-cases/sqs.mdx#creating-sqs-queues) to create SQS queues, it [automatically adds the necessary permissions](https://github.com/getlift/lift/blob/master/docs/queue.md#permissions) to your functions. No need to set up permissions manually!
116+
</Callout>
117+
118+
## Common services and permissions
119+
120+
Here are the IAM actions you'll typically need for common AWS services:
121+
122+
### DynamoDB
123+
```yaml
124+
- Effect: Allow
125+
Action:
126+
- dynamodb:GetItem
127+
- dynamodb:PutItem
128+
- dynamodb:UpdateItem
129+
- dynamodb:DeleteItem
130+
- dynamodb:Query
131+
- dynamodb:Scan
132+
Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/my-table
133+
```
134+
135+
### Secrets Manager
136+
```yaml
137+
- Effect: Allow
138+
Action:
139+
- secretsmanager:GetSecretValue
140+
Resource: arn:aws:secretsmanager:${aws:region}:${aws:accountId}:secret:my-secret-*
141+
```
142+
143+
### SNS (notifications)
144+
```yaml
145+
- Effect: Allow
146+
Action:
147+
- sns:Publish
148+
Resource: arn:aws:sns:${aws:region}:${aws:accountId}:my-topic
149+
```
150+
151+
## Troubleshooting
152+
153+
### Access Denied errors
154+
155+
If you get "Access Denied" errors when trying to use AWS services:
156+
157+
1. Check that you've added the correct IAM permissions in `serverless.yml`
158+
2. Verify the resource ARN is correct (bucket name, queue name, etc.)
159+
3. Make sure you've redeployed after adding permissions
160+
4. [Check the logs](./logs.mdx) for the exact error message
161+
162+
### Testing locally
163+
164+
When testing locally remember that you will need to provide AWS credentials since you're not running on Lambda. You can set them up via long-lived AWS access keys or IAM roles with SSO.
165+
166+
## Learn more
167+
168+
- [`serverless.yml` IAM guide](https://github.com/oss-serverless/serverless/blob/main/docs/guides/iam.md)
169+
- [Documentation of the AWS SDK for PHP](https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/)

‎docs/environment/database-public.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,6 @@ introduction: Configure RDS to expose a RDS database publicly so that you can ac
1212

1313
A secure alternative is to set up an SSH tunnel instead, for example **[using 7777](https://port7777.com/?utm_source=bref)**.
1414

15-
## Limitations
16-
17-
Aurora Serverless databases cannot be made publicly accessible.
18-
1915
## How to
2016

2117
Open the RDS instance in the [RDS console](https://console.aws.amazon.com/rds/home#databases:):

‎docs/environment/storage.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ constructs:
4242
type: storage
4343
```
4444
45-
Read more <a href="https://github.com/getlift/lift/blob/master/docs/storage.md">in the Lift documentation</a>.
45+
Read more [in the Lift documentation](https://github.com/getlift/lift/blob/master/docs/storage.md).
4646
4747
## Application cache
4848

0 commit comments

Comments
 (0)