Lambda sample code for S3 trigger does not work with IAM role

[jkielbaey]

Describe the bug

Under the section Starting workflows from an S3 trigger, the provided sample code for the Lambda function does not work with IAM roles.
After uploading a video file in the S3 bucket, the Lambda function get triggered and send a request to the Workflow API. The error "The security token included in the request is invalid" is returned.

When using IAM roles, the SigV4 process requires to include the session token.

To Reproduce

• Set up S3 trigger as included in the documentation
• Do not replace values for variables access_key and secret_key in the Lambda code.
• Upload file in S3.

Expected behavior

Workflow to be started.

Please complete the following information about the solution:

• Version: [e.g. v1.0.0]

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0021) - Video On Demand workflow with AWS Step Functions, MediaConvert, MediaPackage, S3, CloudFront and DynamoDB. Version v5.0.0". If the description does not contain the version information, you can look at the mappings section of the template:

Mappings:
  MediaInsightsEngine:
    Release:
      Version: "v4.0.1"
  Application:
    SourceCode:
      GlobalS3Bucket: "elementalrodeo99-eu-central-1"
      TemplateKeyPrefix: "content-localization-on-aws/mie-1645122686"
      RegionalS3Bucket: "elementalrodeo99"
      CodeKeyPrefix: "content-localization-on-aws/mie-1645122686"
      Version: "mie-1645122686"

• Region: eu-central-1

[SrAlch]

Hello there!

MediaInsightsEngine:
    Version: "v3.0.2"
SourceCode:
    Version: "v2.0.1"

@giusedroid and I were having a look at this, trying to trigger the Lambda function when uploading a file the the S3 bucket. We found that you need to add x-amz-security-token to the canonical headers, the signed headers and then the headers that are part of the request, looking something like this:

 session_token =  os.environ.get('AWS_SESSION_TOKEN')
 canonical_headers = 'host:' + host + '\n' + 'x-amz-date:' + amz_date + '\n' + 'x-amz-security-token:' + session_token + '\n'
 signed_headers = 'host;x-amz-date;x-amz-security-token'
 headers = {
     'Authorization': authorization_header,
     'Content-Type': content_type,
     'x-amz-date': amz_date,
     'x-amz-security-token': session_token
 }

The main reason for this is that using the temporary credentials of the execution role of the Lambda function requires you to provide the security token as those credentials are part of AWS STS. Link

[giusedroid]

Hey @jkielbaey!

Yup, this was quite a headache to debug :P
If you're an amazon employee, we have an internal sample that we're looking to opensource in the next month or so: feel free to reach out on slack (gbatt) if you want access to a wokring example.