MAAP Auth System

This codebase stores the IaC for authentication and common IAM roles used for the MAAP STAC infrastructure.

Note : Managing cognito users should be done via the console.

Deploying

Requirements

• docker is running
• the AWS CDK CLI is installed
• uv is installed

Installation

uv sync

Locally Run Synthesis:

# Set environment variables for local testing
export STAGE=dev
export OWNER=myname
export STAC_REGISTER_SERVICE_ID=my-service-id

# Test the CDK synthesis locally
uv run cdk synth --all

Cognito resources

Running the example service client

This example script provides you with credentials based on service authentication.

uv run scripts/service-auth-example.py

Expanding

The codebase intends to be expandable to meet MAAP's needs as the project grows. Currently, the stack exposes two methods to facilitate customization.

Adding a Resource Server

A resource server is a service that is to be protected by auth.

stack.add_programmatic_client(client_identifier)

The intention of this endpoint is to create a client for a user to make use of when authenticating in a programmatic environment (e.g. script, notebook).

stack.add_service_client(client_identifier)

Add a service that will be authenticating with the MAAP system. This utilizes the client_credentials flow, meaning that the credentials represent a service rather than any particular user.