Authenticating DynamoDB Using Web Identity Providers

Using AssumeRoleWithWebIdentity API you can authenticate users using web identity providers such as Amazon, Google, Facebook or any other open-id compatible identity provider.

Following steps need to be completed first:

1. Go to IAM

2. Click on Create New Role

3. Select Role for identity provider access

4. Select grant access to identity providers

5. Select the identity provider (e.g. Facebook)

6. After verifying policies, attach policies.

   1. Note: If you are doing this for dynamodb, you can generate a policy document for web identity providers from dynamodb dashboard and use that to create a policy in IAM and then attach it.

Following steps are followed for Authentication:

1. User authenticates with the web identity provider

2. ID provider passes back a token.

3. Need to call AssumeRoleWithWebIdentity from code specifying the token received and the ARN for the IAM role.

4. You get back temporary credentials from Amazon STS (Security Token Service)

5. You code can access the amazon service (e.g. dynamodb). Default expiry is 1 hour.