> For the complete documentation index, see [llms.txt](https://atd-dts.gitbook.io/moped-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atd-dts.gitbook.io/moped-documentation/dev-guides/authentication/dynamodb-and-cognito.md). # DynamoDB & Cognito DynamoDB is a serverless NoSQL database that requires traffic limits provisioning. It’s called that way because it dynamically shards tables based on a proprietary algorithm that hashes a primary key, and distributes the data to a cluster. A successful primary key strategy involves randomizing as much as possible the key and avoid sequences. You can access DynamoDB in this link:\ The tables we created for cognito are extremely simple. Currently, we only have need for at least two fields: * User ID (string uuid) * Claims (string) ![](https://team-1600951431491.atlassian.net/wiki/download/attachments/557084/2020-09-24_09-35-22.png?version=2\&modificationDate=1600958354328\&cacheVersion=1\&api=v2) ### User ID Cognito provides us a UUID string for each individual user, this is what we use as our primary. Since it is random by nature, it’s the perfect pick for our primary key strategy.![](https://team-1600951431491.atlassian.net/wiki/download/attachments/557084/2020-09-24_09-42-31.png?version=1\&modificationDate=1600958595737\&cacheVersion=1\&api=v2)![](https://team-1600951431491.atlassian.net/wiki/download/attachments/557084/2020-09-24_09-42-49.png?version=2\&modificationDate=1600958611826\&cacheVersion=1\&api=v2) ### Claims This field is just a string, in Dynamo it looks like this (encrypted):![](https://team-1600951431491.atlassian.net/wiki/download/attachments/557084/2020-09-24_09-45-31.png?version=2\&modificationDate=1600958755668\&cacheVersion=1\&api=v2) The claims in plain text for a user looks like this: ``` { "x-hasura-default-role": "user", "x-hasura-allowed-roles": ["user"], } ``` The value of this JSON string is completely trivial to DynamoDB, meaning it does not care what is stored there or if it is valid. It only cares if there is a claims column and if the value is a string. | **Diagram owner** | [Data & Technology Services](https://app.gitbook.com/wiki/people/team/92ec81f5-f5e6-4a9a-9376-5eeddf86962f?ref=confluence\&src=fabric) ([Sergio Garcia](https://team-1600951431491.atlassian.net/wiki/people/5f6c958d4147d600774d5e8f?ref=confluence)) | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Team** | | | **Informed** | | | **Status** | | | **Last date updated** | e.g.,24 Sep 2020 | | **On this page** | ![](https://team-1600951431491.atlassian.net/wiki/plugins/servlet/confluence/placeholder/macro?definition=e3RvYzptYXhMZXZlbD0yfG1pbkxldmVsPTJ9\&locale=en_US\&version=2) | | **Name** | **Description** | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Operational Excellence** | The ability to run and monitor systems to deliver business value and to continually improve supporting processes and procedures. | | **Security** | The ability to protect information, systems, and assets while delivering business value through risk assessments and mitigation strategies. | | **Reliability** | The ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. | | **Performance Efficiency** | The ability to use computing resources efficiently to meet system requirements, and to maintain that efficiency as demand changes and technologies evolve | | **Cost Optimization** | The ability to run systems to deliver business value at the lowest price point. | [AWS Well Architected Framework PDF](https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf) note ## Goals * Storing the token Claims for every individual user * Storing the claims safely and not in plain text (keeping them encrypted) * Serverless access to those claims for Cognito ## Architecture ![](https://team-1600951431491.atlassian.net/wiki/download/attachments/557084/cognito_dynamo_map.png?version=1\&modificationDate=1600959852338\&cacheVersion=1\&api=v2) There is no grand architecture in this space; however, a user pool uuid maps directly to the user\_id column in the dynamo db table. ### Architecture flow There are currently two tables in DynamoDB for the use of Cognito 1. atd-moped-users-production 2. atd-moped-users-staging As you may have guessed, one is for each environment in cognito, which also has a staging and production separation. In order to be able to access DynamoDB, the lambda trigger needs to have the following permissions (policy name: [atd-moped-users-cognito-hook-secrets-access](https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/arn%3Aaws%3Aiam%3A%3A295525487728%3Apolicy%2Fatd-moped-users-cognito-hook-secrets-access), role name: [atd-moped-cognito-hook](https://console.aws.amazon.com/iam/home?region=us-east-1#/roles/atd-moped-cognito-hook)) ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:DescribeTable", "dynamodb:GetShardIterator", "dynamodb:GetItem", "dynamodb:Scan", "dynamodb:Query", "dynamodb:GetRecords" ], "Resource": [ "arn:aws:dynamodb:us-east-1:295525487728:table/atd-moped-users-production", "arn:aws:dynamodb:us-east-1:295525487728:table/atd-moped-users-staging" ] } ] } ``` ## Deployment strategy The deployment of the DynamoDB was manual. There is no real need to keep the deployment automated as there aren’t going to be a lot of changes to it. ## SLA Requests Per Second (RPS): The tables present a maximum reads per second and writes per second, this needs to be changed as the amount of traffic changes. ## Action Items | | **Action** | **Description** | **Owner** | **Due date** | **GitHub ticket** | | - | ---------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------- | ----------------- | | 1 | | There needs to be a change in the RPS, currently at 5 r/w ps. | [Sergio Garcia](https://team-1600951431491.atlassian.net/wiki/people/5f6c958d4147d600774d5e8f?ref=confluence) | e.g.,24 Sep 2020 | None Yet. | | 2 | | | | | | ## References and documentation * If you are new to DynamoDB, here is an excellent resource to learn it quickly:\ * Python & DynamoDB (boto3)\