0

I'm considering using AWS pinpoint for sending push notifications to my mobile app. I have created and configured the app through the console, now I want to script against it. The recommended technique to do this is to create an IAM user, give the user access to the pinpoint service and then use the users' credentials.

So I created a user with full access to pinpoint services.

screenshot of user page showing the pinpoint permissions

My policy json is copied directly from the sample http://docs.aws.amazon.com/pinpoint/latest/developerguide/permissions-actions.html except that I removed the mobileanalytics since I only want to use push notifications.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobiletargeting:*",
            ],
            "Resource": "*"
        }
    ]
}

I then copied the user credentials into ~/.aws/credentials and tried to get a list of the apps using the CLI and it gave me an internal server error. I am sure that the format of the credentials file, and the command line that I use is correct because it works if I use root credentials.

Obviously, I am unblocked now because I can just use root access for now, but it would be good to be able to follow AWS best practices.

Works with root credentials

(aws)$ aws pinpoint get-apps
{
    "ApplicationsResponse": {
        "Item": [
            {
                "Id": "7b7a69448a524f94a8bde1c8b2ce9ef7",
                "Name": "emissionphone_MobileHub"
            }
        ]
    }
}

Fails with iam user credentials

(aws)$ cp ~/.aws/credentials.iam_user ~/.aws/credentials
(aws)$ aws pinpoint get-apps

An error occurred (InternalServerErrorException) when calling the GetApps operation (reached max retries: 4): Internal server error

Works again with root credentials

(aws)$ cp ~/.aws/credentials.root ~/.aws/credentials
(aws)$ aws pinpoint get-apps
{
    "ApplicationsResponse": {
        "Item": [
            {
                "Id": "7b7a69448a524f94a8bde1c8b2ce9ef7",
                "Name": "emissionphone_MobileHub"
            }
        ]
    }
}

Note also that it fails with a server error, instead of Access Denied, which seems to indicate an issue with the pinpoint service instead of my credentials...

0

To answer my own question, this is because of the minor change that I made to remove mobileanalytics. If I change the policy to

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobiletargeting:*",
                "mobileanalytics:*"
            ],
            "Resource": "*"
        }
    ]
}

The IAM user credentials work too

(aws)$ cp ~/.aws/credentials.iam_user ~/.aws/credentials
(aws)$ aws pinpoint get-apps
{
    "ApplicationsResponse": {
        "Item": [
            {
                "Id": "7b7a69448a524f94a8bde1c8b2ce9ef7",
                "Name": "emissionphone_MobileHub"
            }
        ]
    }
}

So it looks like the push notifications use mobileanalytics by default whether you want them to or not.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.