【第16回】Amazon Cognito + Spring Sercurityを使ったOAuth2 Loginの実装(5)¶

package org.debugroom.mynavi.sample.aws.microservice.lambda.app.handler;

import com.amazonaws.services.lambda.runtime.Context;
import com.fasterxml.jackson.databind.ObjectMapper;
// omit

import org.springframework.cloud.function.adapter.aws.FunctionInvoker;
import org.springframework.util.StreamUtils;

import org.debugroom.mynavi.sample.aws.microservice.lambda.app.CloudFormationResponseSender;
import org.debugroom.mynavi.sample.aws.microservice.lambda.app.model.Status;

@Slf4j
public class CloudFormationTriggerHandler extends FunctionInvoker { //(A)

    public CloudFormationTriggerHandler(){
        super();
    }

    private ObjectMapper objectMapper = new ObjectMapper();

    @Override
    public void handleRequest(InputStream input, OutputStream output, Context context) throws IOException {
        final byte[] payload = StreamUtils.copyToByteArray(input);  //(B)
        Object request = objectMapper.readValue(payload, Object.class); //(C)
        log.info(request.toString());
        if(request instanceof Map){
            Map<String, Object> inputMap = (Map<String, Object>) request;
            for(String key : inputMap.keySet()){
                log.info("[Key]" + key + " [Value]" + inputMap.get(key).toString());
            }
            Object requestType = inputMap.get("RequestType");
            if(requestType != null && Objects.equals(requestType.toString(), "Delete")){
                CloudFormationResponseSender.send(inputMap, context, Status.SUCCESS,
                inputMap.get("ResourceProperties"), inputMap.get("PhysicalResourceId").toString(), false);  //(D)
            }
            input.reset(); //(E)
            super.handleRequest(input, output, context); //(F)
            if(requestType != null && !Objects.equals("Test", requestType)){
                CloudFormationResponseSender.send(inputMap, context, Status.SUCCESS,
                    inputMap.get("ResourceProperties"), null, false); //(G)
            }
        }
    }

 }

package org.debugroom.mynavi.sample.aws.microservice.lambda.app.function;

import com.amazonaws.services.cognitoidp.AWSCognitoIdentityProvider;
import com.amazonaws.services.cognitoidp.model.DescribeUserPoolClientRequest;
import com.amazonaws.services.cognitoidp.model.DescribeUserPoolClientResult;
import com.amazonaws.services.simplesystemsmanagement.AWSSimpleSystemsManagement;
import com.amazonaws.services.simplesystemsmanagement.model.GetParameterRequest;
import com.amazonaws.services.simplesystemsmanagement.model.GetParameterResult;
import com.amazonaws.services.simplesystemsmanagement.model.PutParameterRequest;
import com.amazonaws.services.simplesystemsmanagement.model.PutParameterResult;

import org.springframework.messaging.Message;
import java.util.function.Function;

// omit

@Slf4j
public class AddClientSecretToParameterStoreFunction
                    implements Function<Map<String, Object>, Message<String>> {  //(A)

    @Autowired
    ServiceProperties serviceProperties;  //(B)

    @Autowired
    CloudFormationStackResolver cloudFormationStackResolver; //(C)

    @Autowired
    AWSCognitoIdentityProvider awsCognitoIdentityProvider;

    @Autowired
    AWSSimpleSystemsManagement awsSimpleSystemsManagement;

    @Override
    public Message<String> apply(Map<String, Object> stringObjectMap) {
        log.info(this.getClass().getName() +  "  has started!");
        String userPoolId = cloudFormationStackResolver.getExportValue(
             serviceProperties.getCloudFormation().getCognito().getUserPoolId());
        String appClientId = cloudFormationStackResolver.getExportValue(
             serviceProperties.getCloudFormation().getCognito().getAppClientId());  //(D)
        String clientSecretParamName = serviceProperties.getSystemsManagerParameterStore().getCognito().getAppClientSecret();
        String clientSecret = getParameterFromParameterStore(clientSecretParamName, true); //(E)
        DescribeUserPoolClientRequest describeUserPoolClientRequest = new DescribeUserPoolClientRequest()
             .withUserPoolId(userPoolId)
             .withClientId(appClientId); //(F)
        DescribeUserPoolClientResult describeUserPoolClientResult = awsCognitoIdentityProvider
             .describeUserPoolClient(describeUserPoolClientRequest); //(G)
        String newClientSecret = describeUserPoolClientResult.getUserPoolClient().getClientSecret(); //(H)

        if(Objects.nonNull(clientSecret)
           && !Objects.equals(clientSecret, newClientSecret)){ //(I)
            PutParameterRequest putParameterRequest = new PutParameterRequest()
                 .withName(clientSecretParamName)
                 .withValue(newClientSecret)
                 .withType("SecureString")
                 .withOverwrite(true); //(J)
            PutParameterResult putParameterResult = awsSimpleSystemsManagement
                 .putParameter(putParameterRequest); //(K)
        }

        return MessageBuilder.withPayload("Complete!").build();
    }

    private String getParameterFromParameterStore(String paramName, boolean isEncripted){
        GetParameterRequest request = new GetParameterRequest();
        request.setName(paramName);
        request.setWithDecryption(isEncripted);
        GetParameterResult getParameterResult = awsSimpleSystemsManagement.getParameter(request);
        return getParameterResult.getParameter().getValue();
    }

}