# 3. 인증정책 기반 서비스 보호

이 기능을 시연하기 위해 우리는 LatticeWorkshop InstanceClient1에서 "Rate API"에 대한 액세스를 허용하는 주차 서비스에 대한 인증 정책을 적용할 것입니다. 단, LatticeWorkshop InstanceClient2에서는 "Rate API"에 액세스할 수 없습니다.

정책에는 LatticeWorkshop InstanceClient2가 "Parking Service"의 "Payment API"에 대한 "http GET"을 수행하도록 허용하고 "POST"를 허용하지 않는 설명도 포함됩니다. 또한 LatticeWorkshop InstanceClient1에서 "Payment API"에 대한 접근을 차단합니다.

<figure><img src="https://1577605304-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fz48CYKN0uwuxPEDHgngc%2Fuploads%2F0iKMbKUMxEZVgHHL8CEc%2Fimage.png?alt=media&#x26;token=e5b064dc-8412-4ce3-bfbb-39c5a59510e4" alt=""><figcaption></figcaption></figure>

### Step1. 인증정책 만들기

아래 "스니펫"을 텍스트 편집기에 복사하고 다음을 교체하여 인증 정책을 준비합니다.

IntanceClient에서 추출한 Role을 변수에 저장합니다.

각 InstanceClient1,2의 터미널에서 확인이 가능합니다.&#x20;

```
cat ~/.bash_profile
```

InstanceClient1\_IAM\_ARN, InstanceClient2\_IAM\_ARN, InstanceClient\_IAM\_ROLE 을 복사해 둡니다.

복사하고 확인된 값을 VSCode 터미널에서 아래와 같이 확인해서 입력합니다.

```
export InstanceClient_IAM_ROLE='latticebaseinfrawithapiserver-SSMRole-xxxxxxx'
export InstanceClient1_IAM_ARN='arn:aws:sts::xxxx:assumed-role/latticexxx-SSMRole-xxxx/i-xxxx'
export InstanceClient2_IAM_ARN='arn:aws:sts::xxxx:assumed-role/latticexxx-SSMRole-xxxx/i-xxxx'
echo "export InstanceClient_IAM_ROLE=${InstanceClient_IAM_ROLE}" | tee -a ~/.bash_profile
echo "export InstanceClient1_IAM_ARN=${InstanceClient1_IAM_ARN}" | tee -a ~/.bash_profile
echo "export InstanceClient2_IAM_ARN=${InstanceClient2_IAM_ARN}" | tee -a ~/.bash_profile
source ~/.bash_profile
```

cloud9 터미널에서 정상적으로 완료했으면, 아래 새로운 정책을 구성하기 위해 snippet을 복사해서 붙여 넣습니다.

```
cat << EOF > ~/environment/auth_policy.json
           {
            "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "${InstanceClient1_IAM_ARN}"
                        },
                        "Action": "vpc-lattice-svcs:Invoke",
                        "Resource": "${parking_svc_arn}/rates"
                    },
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "${InstanceClient2_IAM_ARN}"
                        },
                        "Action": "vpc-lattice-svcs:Invoke",
                        "Resource": "${parking_svc_arn}/payments",
                        "Condition": {
                            "StringEquals": {
                                "vpc-lattice-svcs:RequestMethod": "GET"
                            }
                        }
                    }
                ]
            }
EOF

```

* ${InstanceClient1\_IAM\_ARN} - ["1.사전준비-Step1"](https://whchoi98.gitbook.io/amazon-vpc-lattice/1.#step1.-client)에서 InstanceClient1 의 ARN 으로 대체합니다.
* ${InstanceClient2\_IAM\_ARN} - ["1.사전준비-Step1"](https://whchoi98.gitbook.io/amazon-vpc-lattice/1.#step1.-client)에서 InstanceClient2의 ARN 으로 대체합니다.
* ${parking\_svc\_arn} - ["1.사전준비-Step2"](https://whchoi98.gitbook.io/amazon-vpc-lattice/1.#step2.-service-domain-arn)에서 Parking Service의 ARN으로 대체합니다.

### Step2. 인증정책 적용

"VPC Lattice" - "Services" 에서 parking을 선택합니다.

<figure><img src="https://1577605304-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fz48CYKN0uwuxPEDHgngc%2Fuploads%2FB2On7XMFkOs74yFjiMhu%2Fimage.png?alt=media&#x26;token=2032be63-4463-460e-8e99-0deea82df90f" alt=""><figcaption></figcaption></figure>

"Parking Service"의 "Access" - "Edit access settings"를 선택합니다.

<figure><img src="https://1577605304-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fz48CYKN0uwuxPEDHgngc%2Fuploads%2FTzqsdufG8OxruvjZGDQr%2Fimage.png?alt=media&#x26;token=37b8e50a-70ed-4639-a9bc-b44cd8ecf0ab" alt=""><figcaption></figcaption></figure>

앞서 "스니펫"에서 수정한 IAM 정책을 붙여 넣습니다. 아래 경로에 만들어져 있습니다.

```
cat ~/environment/auth_policy.json

```

<figure><img src="https://1577605304-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fz48CYKN0uwuxPEDHgngc%2Fuploads%2FGSVINZYrpCJkw2StaspH%2Fimage.png?alt=media&#x26;token=ba5839e6-aebe-48cb-a3aa-69362e6fc371" alt=""><figcaption></figcaption></figure>

* Auth Type - AWS IAM
* Auth Policy - 앞서 생성한 IAM 정책
* Save changes

### Step3. 인증정책 기반 서비스 보호 시험.

LatticeWorkshop InstanceClient1은 "Parking Service/Rate API"만 호출할 수 있어야 하며 "Payments API"는 호출할 수 없어야 합니다.

SSM(SystemCenter Session Manager) 콘솔이 닫힌 경우 재접속 후에 IAM 자격을 다시 입력해 줍니다.

```
aws ssm start-session --target $InstanceClient1
source ~/.bash_profile
AWS_SESSION_TOKEN=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE} | jq -r '.Token')
AWS_ACCESS_KEY_ID=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE}  | jq -r '.AccessKeyId')
AWS_SECRET_ACCESS_KEY=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE}  | jq -r '.SecretAccessKey')

```

**LatticeWorkshop InstanceClient1** 콘솔에서 아래 명령을 실행해 봅니다.

```
echo "--------------------------"

curl http://${parking_svc_dns}/rates --aws-sigv4 "aws:amz:ap-northeast-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
sleep 5

echo "--------------------------"

curl http://${parking_svc_dns}/payments --aws-sigv4 "aws:amz:ap-northeast-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"

```

아래와 같은 결과가 수행됩니다.

```
$curl http://parking-0dcc67d057e4a5626.7d67968.vpc-lattice-svcs.us-west-2.on.aws/rates --aws-sigv4 "aws:amz:us-west-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
Hello from "rates"

$curl http://parking-0dcc67d057e4a5626.7d67968.vpc-lattice-svcs.us-west-2.on.aws/payments --aws-sigv4 "aws:amz:us-west-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
AccessDeniedException: User: arn:aws:sts::197153502150:assumed-role/latticebaseinfrawithapiserver-SSMRole-ey7Ooy31ZeaR/i-063ccbb973d44f59c is not authorized to perform: vpc-lattice-svcs:Invoke on resource: arn:aws:vpc-lattice:us-west-2:197153502150:service/svc-0dcc67d057e4a5626/payments because no service-based policy allows the vpc-lattice-svcs:Invoke action
```

LatticeWorkshop InstanceClient2는 http GET 메소드만 사용하여 "parking service' /payments api"를 호출할 수 있어야 하며 "/payments api"에 POST 할 수 없어야 합니다. 또한 "/rates api"에 access하려고 하면 AccessDeniedException이 발생합니다.

SSM(SystemCenter Session Manager) 콘솔이 닫힌 경우 재접속 후에 IAM 자격을 다시 입력해 줍니다.

```
aws ssm start-session --target $InstanceClient2
source ~/.bash_profile
AWS_SESSION_TOKEN=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE} | jq -r '.Token')
AWS_ACCESS_KEY_ID=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE}  | jq -r '.AccessKeyId')
AWS_SECRET_ACCESS_KEY=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/${InstanceClient_IAM_ROLE}  | jq -r '.SecretAccessKey')

```

**LatticeWorkshop InstanceClient2**콘솔에서 아래 명령을 실행해 봅니다.

```
echo "-------------"
curl http://${parking_svc_dns}/rates --aws-sigv4 "aws:amz:ap-northeast-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
sleep 5

echo "-------------"
curl http://${parking_svc_dns}/payments --aws-sigv4 "aws:amz:ap-northeast-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
sleep 5

echo "-------------"
curl -d "hello=world" -X POST http://${parking_svc_dns}/payments --aws-sigv4 "aws:amz:ap-northeast-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
```

아래와 같은 결과가 수행됩니다.

```
$ curl http://parking-0dcc67d057e4a5626.7d67968.vpc-lattice-svcs.us-west-2.on.aws/rates --aws-sigv4 "aws:amz:us-west-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
AccessDeniedException: User: arn:aws:sts::197153502150:assumed-role/latticebaseinfrawithapiserver-SSMRole-ey7Ooy31ZeaR/i-065ec9f267baa4597 is not authorized to perform: vpc-lattice-svcs:Invoke on resource: arn:aws:vpc-lattice:us-west-2:197153502150:service/svc-0dcc67d057e4a5626/rates because no service-based policy allows the vpc-lattice-svcs:Invoke action

$ curl http://parking-0dcc67d057e4a5626.7d67968.vpc-lattice-svcs.us-west-2.on.aws/payments --aws-sigv4 "aws:amz:us-west-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
Hello from "payments"

$ curl -d "hello=world" -X POST http://parking-0dcc67d057e4a5626.7d67968.vpc-lattice-svcs.us-west-2.on.aws/payments --aws-sigv4 "aws:amz:us-west-2:vpc-lattice-svcs" --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" --header "x-amz-security-token:$AWS_SESSION_TOKEN" --header "x-amz-content-sha256:UNSIGNED-PAYLOAD"
AccessDeniedException: User: arn:aws:sts::197153502150:assumed-role/latticebaseinfrawithapiserver-SSMRole-ey7Ooy31ZeaR/i-065ec9f267baa4597 is not authorized to perform: vpc-lattice-svcs:Invoke on resource: arn:aws:vpc-lattice:us-west-2:197153502150:service/svc-0dcc67d057e4a5626/payments because no service-based policy allows the vpc-lattice-svcs:Invoke action
```
