How to enable anonymous access using AWS javascript SDK? - aws-sdk

Question

We would like to enable anonymous access to some of our AWS resources e.g DynamoD, Polly etc.
We have scoured the internet trying to look for some usable documentation or examples but could not find any.

Answer 1

When you have the need to provide anonymous access to AWS resources, there are several best practices you need to follow to avoid potential security issues.
Never expose AWS IAM access keys and secrets to the public and instead create a backend endpoint which can request for temporal credentials from AWS STS and share the temporal credentials with client. Another alternative option is to use AWS Cognito Identity SDK with anonymous access.
Have fine grained access control policies with deny all and only granting the specific resources (e.g. DynamoDB Raw/Table, S3 Bucket/Object & etc.).
Setup some services public and put others behind them ( e.g DynamoDB can be allowed to access behind AWS API Gateway, where requests can be throttled. Another example is using AWS CloudFront infront of S3 with AWS WAF where certain security restrictions can be applied).

Answer 2

In your policy for those resources your Principal should be *.
Reference documentation for anonymous users,
http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html (search for Everyone (anonymous users) for more info)
E.g.,
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DescribeQueryScanBooksTable",
"Effect": "Allow",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:Query",
"dynamodb:Scan"
],
"Principal": "*"
}
]
}
Hope it helps.

Answer 3

#Ashan's answer is full of good advice; I'll be giving it an upvote. Just to expand on it a bit:
IAM and anonymous access
These types of resources are typically secured by IAM. So your application that allows access to these resources will need IAM keys. As #Ashan pointed out, you don't want to hard code these keys in your application.
Amazon's advice can be found here:
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html
Javascript example (using Cognito SDK)
There is a javascript example here. You just call Cognito once to get an identity, and a second time to get IAM keys. Then you can use the S3, DynamoDB, or other SDKs to access your resources.
Cognito
Finally, I would recommend using Cognito over calling the STS APIs yourself. Amazon provides a nice SDK for this under the Cognito umbrella, and this particular Cognito functionality free to use.
Once you set up a Federated Identity Pool with Unauthenticated Indentities enabled, you can use the code from the javascript example above.
Accessing services once you have your IAM keys from Cognito:
http://docs.aws.amazon.com/cognito/latest/developerguide/accessing-aws-services.html