備忘録
Lambdaの実行ロールに対する許可
Collectionに対するAPIアクセスを許可
{
"Effect": "Allow",
"Action": [
"aoss:APIAccessAll",
"aoss:BatchGetCollection",
],
"Resource": "*"
}
APIAccessAllのResource指定はワイルドカードでなければcollection/<collection-id>。
BatchGetCollectionは必ずしも必要でないが、コレクションがACTIVEになるのを待機するなどで必要。Resource指定はワイルドカードである必要あり。
Data Access Policy
{
"Resource": [
"index/<collection-name>/*"
],
"Permission": [
"aoss:UpdateIndex",
"aoss:DescribeIndex",
"aoss:ReadDocument",
"aoss:WriteDocument",
"aoss:CreateIndex",
"aoss:DeleteIndex",
],
"ResourceType": "index"
}
CollectionのNetwork Policy
{
"Description":"Public access for finance collection",
"Rules":[
{
"ResourceType":"dashboard",
"Resource":[
"collection/<collection-name>"
]
},
{
"ResourceType":"collection",
"Resource":[
"collection/<collection-name>"
]
}
],
"AllowFromPublic":true
}
ここでのResource指定はcollection/<collection-name>
APIコール時の認証に必要なパラメータ
SigV4Authによる認証
x-amz-content-sha256ヘッダー
x-amz-security-tokenヘッダー
headers = {}
if content_type:
headers['Content-Type'] = content_type
request = AWSRequest(method=method, url=url, data=body_bytes, headers=headers)
payload_hash = hashlib.sha256(body_bytes).hexdigest()
request.context['payload_hash'] = payload_hash
request.headers['x-amz-content-sha256'] = payload_hash
if frozen_credentials.token:
request.headers['x-amz-security-token'] = frozen_credentials.token
SigV4Auth(frozen_credentials, service, region).add_auth(request)
signed_headers = dict(request.headers)
response = http.request(
method,
url,
body=body_bytes,
headers=signed_headers
)
Discussion