Skip to content

Commit 483f961

Browse files
authored
Functions: Clean up AWS APIs example(s) (#2878)
* Functions / AWS APIs: Fix JSON formatting * Functions / AWS APIs: Clean up code example
1 parent ff33b1d commit 483f961

File tree

1 file changed

+20
-25
lines changed

1 file changed

+20
-25
lines changed

src/connections/functions/aws-apis.md

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,41 +13,41 @@ To set up your functions to call AWS APIs:
1313
2. Create an IAM role in your AWS account with the [minimum set of necessary permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege){:target="_blank"}.
1414
3. Add a trust relationship to your role with the following policy, filling in the principal account ID and external ID from step 1.1:
1515
```json
16-
{
17-
"Version": "2012-10-17",
18-
"Statement": [
19-
{
20-
"Effect": "Allow",
21-
"Principal": {
22-
"AWS": "<PRINCIPAL_ACCOUNT_ID>"
23-
},
24-
"Action": "sts:AssumeRole",
25-
"Condition": {
26-
"StringEquals": {
27-
"sts:ExternalId": "<EXTERNAL_ID>"
16+
{
17+
"Version": "2012-10-17",
18+
"Statement": [
19+
{
20+
"Effect": "Allow",
21+
"Principal": {
22+
"AWS": "<PRINCIPAL_ACCOUNT_ID>"
23+
},
24+
"Action": "sts:AssumeRole",
25+
"Condition": {
26+
"StringEquals": {
27+
"sts:ExternalId": "<EXTERNAL_ID>"
28+
}
2829
}
2930
}
30-
}
31-
]
32-
}
31+
]
32+
}
3333
```
3434

3535
2. Create your function.
3636
<br> Now that you have an IAM role in your AWS account, you can create your source or destination function. Segment recommends you to use function settings to make the IAM role configurable. This allows you to use different roles for different instances of your function and to securely store your external ID value by making it a "sensitive" setting. Here are the required settings:
3737
* **IAM Role ARN**: A string setting that is the ARN for the IAM role above. For example, `arn:aws:iam::1234567890:role/my-secure-role`.
3838
* **IAM Role External ID**: A sensitive string setting that is the external ID for your IAM role.
3939

40-
Below is an example destination function that uploads each event received to an S3 bucket (configured using an additional "S3 Bucket" setting). It uses the built-in local cache to retain S3 clients between requests to minimize processing time and to allow different instances of the function to use different IAM roles.
40+
Below is an example destination function that uploads each event received to an S3 bucket (configured using additional "S3 Bucket" and "S3 Bucket Region" settings). It uses the built-in local cache to retain S3 clients between requests to minimize processing time and to allow different instances of the function to use different IAM roles.
4141

4242
```javascript
4343
async function getS3(settings) {
4444
const ttl = 30 * 60 * 1000; // 30 minutes
45-
const key = settings.iamRoleArn + settings.iamRoleExternalId;
45+
const key = [settings.iamRoleArn, settings.s3Bucket].join();
4646

4747
return cache.load(key, ttl, async () => {
4848
const sts = new AWS.STS();
4949

50-
const creds = await sts
50+
const opts = await sts
5151
.assumeRole({
5252
RoleArn: settings.iamRoleArn,
5353
ExternalId: settings.iamRoleExternalId,
@@ -56,16 +56,14 @@ To set up your functions to call AWS APIs:
5656
.promise()
5757
.then(data => {
5858
return {
59+
region: settings.s3BucketRegion,
5960
accessKeyId: data.Credentials.AccessKeyId,
6061
secretAccessKey: data.Credentials.SecretAccessKey,
6162
sessionToken: data.Credentials.SessionToken
6263
};
63-
})
64-
.catch(err => {
65-
throw err;
6664
});
6765

68-
return new AWS.S3(creds);
66+
return new AWS.S3();
6967
});
7068
}
7169

@@ -81,9 +79,6 @@ To set up your functions to call AWS APIs:
8179
.promise()
8280
.then(data => {
8381
console.log(data);
84-
})
85-
.catch(err => {
86-
throw err;
8782
});
8883
}
8984
```

0 commit comments

Comments
 (0)