Access DynamoDB from /api/

[michaelmerrill]

Do you have a recommended flow for working with AWS resources like DynamoDB?

I have an api endpoint at /api/signup that creates a user in dynamodb.

const createParams = {
    TableName: process.env.USERS_TABLE_NAME,
    Item: user,
};
await dynamoDb.put(createParams).promise();

When I run next locally I use an AWS_PROFILE to connect to the AWS resource.

AWS_PROFILE=dev yarn start

However, once deployed Vercel sets its own AWS_ACCESS_KEY_ID and SECRET which does not have access to my resources. I know I can set the key and secret in the aws-skd, but then this will prevent the AWS_PROFILE from working.

Anyone have a better development flow for working with aws resources?

[harrysolovay]

It doesn't seem that we can attach policies to the roles of the Lambdas that Vercel deploys on our behalf (API routes / getServerSideProps). User and role credentials expire. It seems we're unable to use Vercel while simultaneously following best practices for authorizing access to AWS resources.

This deployment solution seems decent (although I'm hesitant to use it myself). I'd be very grateful if a Vercel team member could offer clarity. & apologies if I missed some docs... although I don't believe I have.

[timneutkens]

Can you make sure you're on the latest stable version of Next.js?

[harrysolovay]

I am (9.4.4)

[harrysolovay]

@timneutkens – thoughts?

[Timer]

You should rename the environment variables.

See https://github.com/vercel/preview-mode-demo/blob/master/src/pages/api/save.tsx

[harrysolovay]

The issue is, you still either (A) need to manually set and update credentials or (B) are unable to give those credentials access to specific AWS resources in your account (because the API routes are managed).

[Timer]

That is correct—you need to manually set the credentials.

[leerob]

Here's an AWS example with S3 and CDK for Infra. Not exactly what you're looking for (Dynamo) but it might help point you in the right direction.

https://github.com/leerob/nextjs-aws-s3/

[harrysolovay]

@Timer @leerob using global AWS credentials is not a solution with which all users will feel comfortable. Being able to interact with API route roles would allow users to follow security practices, such as automated credential rotation. I don't know how you'd offer the power-user experience within the managed service... it's a shame that we otherwise lose out on the API route serialization magic. It does seem like this is a catch 22 of building a business around open source. Whatever the case, I love what you and the team are doing!

[leerob]

Created an example for you. It doesn't use global credentials – it uses a specific IAM use to lock down permissions. Not perfect, but hopefully gets you in the right direction!

https://github.com/leerob/nextjs-aws-dynamodb

[harrysolovay]

Thank you!!!

[leerob]

Hopefully this helps! https://vercel.com/templates/next.js/aws-dynamodb-with-nextjs-api-routes