Welcome back,
and in this AdvancedDemo series,
you're going to get the chance
to build a really simple serverless application
which makes use of web identity federation.
Now, it's going to be a simple example
but all of the products and techniques that you'll use
will be equally as applicable for bigger,
more complex projects.
Now, to be efficient, we're going to start off by applying
a CloudFormation template
which will create some base infrastructure.
This is going to take some time to apply,
and while it's working away,
I can step you through the architecture,
so you understand how it works step by step.
So go ahead and move to the AWS console.
You'll need to be logged in
to an AWS account with admin permissions
and make sure that you have
the Northern Virginia region selected.
Now, once that's done, there's a link
attached to this lesson for a one-click deployment.
So go ahead and click that link.
That's going to move you to the quick create stack screen.
Everything should be pre-populated.
All you'll need to do is scroll down to the bottom,
check the capabilities box, and then click on create stack.
Now, that's going to take a few minutes to create,
and while that's happening, let's talk about architecture.
Now, what we're going to implement looks complicated
but it's not really.
What we have is a user, Jenny,
and this user is going to use our serverless application.
Now, the end goal is to access a private bucket
containing pictures of Patches, the wonder cat.
And right now, that's not possible
because that bucket is private.
It has no public access.
So what you're going to be implementing is a system
where Jenny loads a serverless application
which is hosted within an S3 bucket called the app bucket
and this is going to be loaded through CloudFront.
Now, this application contains HTML
which loads in Jenny's browser together with JavaScript
which runs in her browser.
This is the front end to the serverless application.
Now, this HTML and JavaScript,
which I'll call the application from now on,
shows a sign-in box.
So Jenny clicks that and she's directed at Google
which is our identity provider.
So Jenny clicks that, and she's directed at Google,
which in this case, is our identity provider.
So at this point, Jenny's prompted to authenticate.
And if this process is successful,
then a Google authentication token is returned.
And you can think of this as evidence
that Jenny has authenticated.
It proves her identity.
Now, as you know by now, you can't use AWS resources
with anything but AWS credentials.
And so this OAth token can't be used
to access anything inside AWS,
including our S3 bucket containing our private cat pictures.
What we need to do is exchange this authentication token
for AWS credentials
which can be used to access AWS resources.
And to do this, Cognito is used.
By this point, you'll have configured Cognito
to accept Google authentication tokens
as evidence of identity,
and Cognito using an identity pool will then swap the token
for temporary credentials by assuming an IAM role.
Now that these credentials exist,
they can be returned to Jenny.
And now that Jenny has temporary credentials,
the serverless application can use these
to access the private bucket.
And all of this is done without any self-managed servers,
without managing any identity infrastructure,
and it has no real base costs
until you start using the system.
Now this might look complicated,
but we're going to do it step by step.
Step one is the base infrastructure,
which is what the CloudFormation template is doing
in the background right now.
Specifically, it's implementing the first part.
So right now, you're applying the template,
and I'll refer to you as Bob.
And as you apply the template
into the CloudFormation service,
this creates a CloudFormation stack
which creates the actual resources.
It's creating the application bucket
and the private patches bucket,
as well as the CloudFront distribution
that you'll be accessing the application through.
Now, that distribution is not actually contained
on this diagram because we won't be using it initially,
but we will be using it later on in the demo series.
Now, it's also creating some custom resources,
Lambda functions, which copy assets into these buckets.
So by the time the CloudFormation stack completes,
you'll have the application bucket
to load files from via a CloudFront distribution,
but at this point, you'll be unable to access
the private patches bucket because it's private.
So the initial architecture that we're implementing
is relatively simple, but we're going to extend it
as we move through this demo series.
So let's quickly move back to the AWS console
and check if the creation process has completed.
We can see the stacks moved into the create complete state.
And if we click on the Resources tab,
we'll be able to see all of the resources
that have been created by this stack.
Now, I want to check that a few of these resources
have completed successfully.
So specifically, I want you to click in the search box
at the top and type S3, and then open that in a new tab.
When you're at the S3 console,
this will list all of the buckets
that are in this AWS account,
and specifically, I want you to look at the ones
that start webidf.
If you look at those,
you'll see that we have an application bucket,
and we'll have a private patches bucket.
Now, if you go inside this application bucket,
you'll note that we have two files,
index.html and scripts.js,
and these form the web application.
These are what will load into your browser
and provide the application functionality.
If we move back to the main S3 console
and go inside the private patches bucket,
you'll see that this contains three images.
If you open each one of these images, in turn,
you'll see that these are all pictures
of Patches, the wonder cat.
And it's useful if you become familiar
with exactly what these look like
for later in this demo series.
So open these up each one by one
and you'll see that they're all pictures
of Patches, the wonder cat.
And currently, these are private.
They're not accessible unless you have permissions.
Now, let's move back to the main AWS console.
This time, click in the search box at the top
and type CloudFront, and then open that in a new tab.
You'll see that you have one CloudFront distribution,
and that one distribution should be pointing
at the application bucket as its origin.
Go ahead and click on this distribution to go inside.
And I'll want you to note down the distribution domain name,
so that's this box on the left.
Go ahead and click on the icon next to it
to copy this into your clipboard
and note this down somewhere safe.
This is the web app URL.
You're going to need this later on in the demo series.
Now at this point, that's everything
that I wanted you to complete
in this stage of the demo series.
So go ahead and complete this video and when you're ready,
I'll look forward to you joining me in the next stage.