Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Scale AWS resource management in access flows
Learn how to complete an AWS integration in the Apono UI
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"organizations:*",
"ssm:*",
"cloudformation:*",
"resource-explorer-2:*",
"ram:*",
"iam:PassRole"
],
"Resource": "*"
}
]
}
"username": "REDSHIFT_USERNAME",
"password": "PASSWORD"CREATE USER apono_connector WITH PASSWORD 'password';
ALTER USER apono_connector WITH CREATEUSER;
CREATE USER apono_connector WITH PASSWORD 'secret_passwd';CREATE USER apono_connector;
GRANT rds_iam TO apono_connector;{
"Version": "2012-10-17",
"Statement": [
{
"Action": "rds-db:connect",
"Resource": "arn:aws:rds-db:*:*:dbuser:*/apono_connector",
"Effect": "Allow"
}
]
}ALTER USER apono_connector WITH CREATEROLE;
GRANT rds_superuser TO apono_connector;{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds-db:connect"
],
"Resource": [
"arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
]
},
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances"
],
"Resource": [
"arn:aws:rds:*:*:db:*"
]
}
]
}
function listResources(params) {
return {
resources: [
{
'id': 'resource1',
'name': 'Resource 1',
'type': params.resource_type,
'metadata': {
'key1': 'value1'
}
},
{
'id': 'resource2',
'name': 'Resource 2',
'type': params.resource_type,
'metadata': {
'key2': 'value2'
}
},
{
'id': 'resource3',
'name': 'Resource 3',
'type': params.resource_type,
'metadata': {
'key3': 'value3'
}
},
],
permissions: [
{
'id': 'admin',
'name': 'Admin'
},
{
'id': 'reader',
'name': 'Reader'
}
]
};
}
function grantAccess(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const permission = params.permission;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
console.log(param1)
console.log(param2)
return {
status: 'ok'
};
}
function revokeAccess(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const permission = params.permission;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
return {
status: 'ok'
};
}
function createCredentials(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
return {
status: 'ok'
};
}
export const handler = async (event) => {
const params = event.params;
switch (event.event_type) {
case 'create-credentials':
return createCredentials(params);
case 'list-resources':
return listResources(params);
case 'grant-access':
return grantAccess(params);
case 'revoke-access':
return revokeAccess(params);
case 'create-credentials':
return {
status: 'ok',
secret: 'created-credentials-secret'
}
case 'reset-credentials':
return {
status: 'ok',
secret: 'reset-credentials-secret'
}
default:
return {
status: 'active'
};
}
};aws rds describe-db-instances \
--filters "Name=engine,Values=mysql" \
--query "*[].[Endpoint.Address,Endpoint.Port]"
mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -paws rds describe-db-instances \
--filters "Name=engine,Values=mysql" \
--query "*[].[DBInstanceIdentifier,Endpoint.Address,Endpoint.Port]"mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -pCREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';GRANT ROLE_ADMIN on *.* to USER_NAME;aws rds describe-db-instances \
--filters "Name=engine,Values=mysql" \
--query "*[].[DBInstanceIdentifier,Endpoint.Address,Endpoint.Port]"aws rds describe-db-instances \
--filters "Name=engine,Values=mysql" \
--query "*[].[Endpoint.Address,Endpoint.Port]"
mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -paws rds modify-db-instance \
--db-instance-identifier DBInstanceIdentifier \
--apply-immediately \
--enable-iam-database-authenticationmysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -pCREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';{ "Version": "2012-10-17", "Statement": [ { "Action": "rds-db:connect", "Resource": "arn:aws:rds-db:::dbuser:*/USER_NAME", "Effect": "Allow" } ] }aws iam create-policy --policy-name RDSConnectPolicy --policy-document '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds-db:connect"
],
"Resource": [
"arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
]
},
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances"
],
"Resource": [
"arn:aws:rds:*:*:db:*"
]
}
]
}'mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -pCREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';GRANT ROLE_ADMIN on *.* to USER_NAME;CREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';GRANT ROLE_ADMIN on *.* to USER_NAME;aws rds modify-db-instance \
--db-instance-identifier DBInstanceIdentifier \
--apply-immediately \
--enable-iam-database-authenticationmysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -pCREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';{ "Version": "2012-10-17", "Statement": [ { "Action": "rds-db:connect", "Resource": "arn:aws:rds-db:::dbuser:*/USER_NAME", "Effect": "Allow" } ] }aws iam create-policy --policy-name RDSConnectPolicy --policy-document '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds-db:connect"
],
"Resource": [
"arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
]
},
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances"
],
"Resource": [
"arn:aws:rds:*:*:db:*"
]
}
]
}'CREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';
GRANT EXECUTE,DROP,SELECT,ALTER,ALTER ROUTINE,CREATE,CREATE ROUTINE,CREATE TEMPORARY TABLES,CREATE VIEW,DELETE,INDEX,INSERT,TRIGGER,UPDATE ON *.* TO 'USER_NAME'@'%';
GRANT GRANT OPTION ON *.* TO 'USER_NAME'@'%';{ "Version": "2012-10-17", "Statement": [ { "Action": "rds-db:connect", "Resource": "arn:aws:rds-db:::dbuser:*/USER_NAME", "Effect": "Allow" } ] }{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds-db:connect"
],
"Resource": [
"arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
]
},
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBInstances"
],
"Resource": [
"arn:aws:rds:*:*:db:*"
]
}
]
}