Install the AWS Lambda@Edge Enforcer

AWS IAM Setup

The AWS Lambda@Edge installation consists of three parts. Be sure to complete each part in order.

1. Create an IAM Policy to use with an AWS IAM account
2. Assign an AWS IAM account with required permissions
3. Create an AWS Access Key

Create an AWS IAM Policy

You need to create a new IAM Policy with the necessary permissions to deploy the AWS Lambda@Edge Enforcer.

1. Navigate to the AWS Console > IAM Dashboard > Policies and click Create Policy.
2. In Step 1, Specify permissions > Policy editor, click JSON.
3. Replace the JSON that appears with the JSON below.

1
{
2
	"Version": "2012-10-17",
3
	"Statement": [
4
		{
5
			"Effect": "Allow",
6
			"Action": [
7
				"lambda:CreateFunction",
8
				"lambda:UpdateFunctionCode",
9
				"lambda:UpdateFunctionConfiguration",
10
				"lambda:PublishVersion",
11
				"lambda:GetFunction",
12
				"lambda:ListFunctions",
13
				"lambda:InvokeFunction",
14
				"lambda:EnableReplication",
15
				"cloudfront:CreateDistribution",
16
				"cloudfront:UpdateDistribution",
17
				"cloudfront:GetDistribution",
18
				"cloudfront:ListDistributions",
19
				"cloudfront:ListCachePolicies",
20
				"cloudfront:CreateCachePolicy",
21
				"cloudfront:GetDistributionConfig",
22
				"iam:CreateRole",
23
				"iam:AttachRolePolicy",
24
				"iam:PutRolePolicy",
25
				"iam:PassRole",
26
				"iam:GetRole",
27
				"iam:ListRoles",
28
				"iam:GetUser"
29
			],
30
			"Resource": "*"
31
		}
32
	]
33
}

4. Click Next and provide a Policy name.
5. Click Create Policy.

Next, move on to Assign AWS IAM account permissions.

Assign AWS IAM account permissions

Your goal is to have at least one AWS IAM user with permission to send request to different AWS APIs. You can do this by either creating a new AWS IAM account or editing permissions for an existing account.

Option 1: Create a new AWS IAM account

1. Navigate to the AWS Console > IAM Dashboard > Users and click Create user.
2. In Step 1, Specify User Details, provide a user name and click Next.
3. In Step 2, Set permissions:
   1. In the Permissions options, choose Attach policies directly.
   2. In the Permissions policies area that appears, click the checkbox next to the Policy you created in Create an AWS IAM Policy.
4. Click Next. Then, in Step 3, Review and create, click Create user.

Next, move on to Create an AWS Access Key.

Option 2: Edit an existing AWS IAM account

1. Navigate to the AWS Console > IAM Dashboard > Users.
2. Click the user you want to add permissions to.
3. Under Permissions > Permissions policies, click Add permissions > Add permissions.
4. From Step 1, Add permissions:
   1. In Permissions options, choose Attack policies directly.
   2. In the Permissions policies area that appears, click the checkbox next to the Policy you created in Create an AWS IAM Policy.
5. Click Next. Then, in Step 2, Review, click Add permissions.

Next, move on to Create an AWS Access Key.

Create an AWS Access key

1. Navigate to the AWS Console > IAM Dashboard > Users and select the user you just created or edited from Assign AWS IAM account permissions.
2. Click the Security credentials tab.
3. Navigate to the Access keys area and click Create access key.
4. In Step 1, Access key best practices & alternatives, select Other as the Use case. Then, click Next.
5. If you’d like, add a description. Otherwise, click Create access key.
6. Copy the Access key and Secret access key that appear.

Run the Deploy Tool

First, download and run the Deploy Tool. You can do this by either pulling a Docker image or running a script.

$
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool

$
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool

Deploy the Enforcer

After you run the Deploy Tool, you’ll be prompted with steps to deploy the Enforcer.

1. When prompted, select AWS Lambda@Edge and hit Enter.

$
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
$
? Which platform do you want to deploy to? (Use arrow keys)
$
  ...
$
❯ AWS Lambda@Edge
$
  ...

2. Follow the prompts that appear to complete the setup process.
3. After you complete the setup, confirm that the displayed details are correct, then enter y to deploy the Enforcer.

Enable CloudWatch logs (recommended)

We recommend creating an IAM role for each Lambda you upload. This lets the function create log groups and log streams in CloudWatch. When you deploy a Lambda@Edge function, it distributes across all edge cache locations, and all logs from the Lambda related to those regions will appear in the CloudWatch logs of their respective edge cache areas. For example, if a user accesses the us-east-1 region, the corresponding logs will be found in us-east-1.

1
{  
2
"Version": "2012-10-17",  
3
"Statement": \[  
4
    {  
5
        "Effect": "Allow",  
6
        "Action": "logs:CreateLogGroup",  
7
        "Resource": "arn:aws:logs:_:_:_"  
8
    },  
9
    {  
10
        "Effect": "Allow",  
11
        "Action": [  
12
            "logs:CreateLogStream",  
13
            "logs:PutLogEvents"  
14
        ],  
15
        "Resource": \[  
16
            "arn:aws:logs:_:_:log-group:_:\*"  
17
        ]  
18
    }  
19
  ]  
20
}