Just jumped on a quick zoom call with @Julien Goux to answer some questions about SST. And I want to share what we talked about here in case others find it helpful. • For Auth, you can choose Cognito User Pool + Cognito Identity Pool, or Auth0 + Cognito Identity Pool. Whichever authentication provider you choose, you have to use Cognito Identity Pool to grant temporary IAM credentials for the authenticated users. Take a look at the sst.Auth construct. It supports Cognito User Pool + Cognito Identity Pool setup right now. But if anyone needs Auth0 + Cognito Identity Pool setup, msg me. I will add it in. • For S3 upload, you should directly upload from your React frontend. Cognito Identity Pool will issue IAM credentials to logged in users. You can setup IAM permissions such that each logged in user have their own “folder” in the S3 bucket. Example here. • For VPC, yes your Lambdas need to be deployed to VPC to talk to RDS. If you place the RDS in private subnet (which is recommened from the security perspective), for your local function (ie. run

sst start

) to access RDS, you’d need to setup VPN. The easier approach is placing RDS in public subnet and publically expose the port. The latter is easier and cheaper to setup. And the security takeoff I think is fine if you are developing in a separate AWS account. • Yes, you can use ALL CDK constructs in SST. • Yes, SST deploys directly to your AWS account. No 3rd party services in between. The added cost for SST is the communication between your local function and your Lambda function through a websocket API, which is neglegible and covered in the free tier. FYI, The pricing for AWS websocket API is $1 per 1M requests beyond free tier.

hi @Frank, we'll be using Auth0 and could benefit from having support for it? it this something you guys could add quickly or do you recommend using a workaround for now?

I can add support for it today or tmr. Would that work for you?

that would be great! thank you. We are not super familiar with Cognito, what would you say would be the main benefit from using the identity pool vs not using it? more robust and flexible? in the past we used something similar to this https://github.com/auth0-samples/jwt-rsa-aws-custom-authorizer/blob/master/lib.js#L60 basically assigned a specific policy

From what I understand, when using Auth0 as an authorizer, it only protects the API. And the line of code you highlighted is responsible for granting what IAM permissions for the API.

yeah that's what i was thinking, seems more flexible vs assigning only a specific permission

yeah.. also easier if you want to switch auth provider at some point

yeah that's a good point

You just need to provide the

Provider URL

and

Audience

to

sst.Auth

, and SST will do step 1 to 6 for you.

that would be great 🙌