Title: Security and efficiency in AWS backend architecture for a simple meeting app (DynamoDB?)
Tags: amazon-web-services;amazon-dynamodb;amazon-iam
Question: I am building a simple application (IOS) where each user can send a meeting invitation to one or several Facebook friends of his. A meeting consists of a date, a location and the group of people involved (somehow replicating what Facebook already does for events). I decided to use AWS for my backend but even though this seems to be a simple and classical use case, I can't think of a solution which is both efficient and secure. In the following, I expose the way I built my backend until now and then I point out some of its weaknesses I can think of.
I use Web Identity Federation with Facebook instead of Cognito for the reasons explained here. I use a unique DynamoDB table for all my users (inspired by this Amazon document) where the primary key is the user Facebook ID. Each user can only query and get the rows corresponding to his Facebook ID but she can write rows with any primary key she wants.
Here is the IAM policy attached to the role I created:
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:Query"
],
"Resource": [
"arn:aws:dynamodb:eu-west-1:528570751657:table/Meetings",
"arn:aws:dynamodb:eu-west-1:528570751657:table/Meetings/index/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": [
"${graph.facebook.com:id}"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem"
],
"Resource": [
"arn:aws:dynamodb:eu-west-1:528570751657:table/Meetings",
"arn:aws:dynamodb:eu-west-1:528570751657:table/Meetings/index/*"
]
}
How it works in practice: Let's say that the user with the Facebook ID 1001 wants to send a meeting invitation to two of his Facebook friends with IDs 1002 and 1003. To do so, she writes 3 times the same row with the same meeting information but using three different primary keys: 1001, 1002 and 1003. After that, each user has a copy of the meeting which she can retrieve from the table while synchronizing with DynamoDB (query request).
Problems I can think of:
Rows are duplicated between accounts: suboptimal storage management.
It is not possible to update an existing meeting.
Users can access anybody's account, not only their friends. Even more dangerous: it is possible to use any account to arrange fake meetings between people.
That said, I think I am missing something about how AWS should be used here. I feel like permission management in IAM for DynamoDB is not flexible enough. Should I keep using DynamoDB but try to use it in some other way? Should I completely change my architecture?

Here is the accepted answer: It looks like your use case requires some more advanced DynamoDB techniques and having the mobile device directly access the DynamoDB table is probably too restrictive based on the limitations imposed by Cognito.
I'd recommend looking into using API Gateway with AWS Lambda to create your own API that can still be authenticated using Cognito, but you can have more advanced business logic be performed by your application to ensure everything is still secure.


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2016:00:04/08/16', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<amazon-web-services><amazon-dynamodb><amazon-iam>', 'Title': 'Security and efficiency in AWS backend architecture for a simple meeting app (DynamoDB?)', 'ViewCount': 81, 'id': 36497354, 'user_AboutMe': '', 'user_AccountId': 8114559.0, 'user_DisplayName': 'Hatim Khouzaimi', 'user_Reputation': 515.0, 'user_Views': 48.0, 'user_id': 6113498.0}}