anonymous read with amazon simpledb

Question

I would like to query simpledb directly from the client using javascript. My application is read-heavy and I rather not route the request through my application server. Is i

Answer 1

This is possible using AWS IAM (Identity and Access Management) and a server side "token vending machine". AWS docs have an article specifically written for the use case Authenticating Users of AWS Mobile Applications with a Token Vending Machine and sample code for server, iOS, and Android in GitHub. The general technique can be used for non-mobile and/or for JavaScript clients.

Note: a server component is still required to vend out the temporary access tokens. However, the volume of these requests can be significantly reduced (up to once every 36 hours). The remaining requests are from untrusted client to SimpleDB directly, no intermediary.

General Technique

1. anonymous client calls your token vending machine (your server)
2. token vending machine knows the secret key, calls AWS to generate a temporary token
   • token is created with read-only access policy (example below)
   • token lasts for a maximum of 36 hours, default 12 hours (api docs)
3. vending machine returns token to client
4. client calls simpleDB API using anonymous, temporary token; cannot write to SimpleDB

Read Only Access Policy

From AWS sample code "Read Only Access Policy"

{
  "Statement": [
    {
      "Action": ["sdb:GetAttributes", "sdb:List*", "sdb:Select*"],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

This extends beyond SimpleDB. You can set an access policy for several other AWS resources (see full access policy example).

Variation to Replace Dynamic Client-Server calls with Static Resource

Although you cannot eliminate a server component, clients don't necessarily have to talk to the vending machine directly:

1. scheduled job generates token every N seconds where N + fudge == token expiry
2. job writes token to public S3 bucket (or any other static resource)
   • set appropriate maxAge cache-control header based on fudge
3. anonymous client reads token from static URI
4. client authenticates with token, makes read-only calls to SimpleDB

Answer 2

You would need to sign all requests with your server. I think that's what you mean anyway. You could still save some bandwidth.

I'd say, as soon as a JavaScript client can authenticate itself, everyone could.

Answer 3

An authentication server is required, you can use EC2 for this.