@startuml Amazon S3 objects using IAM Temporary Credentials

title Amazon S3 objects using IAM Temporary Credentials
' compare with https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html

' Uncomment the line below for "dark mode" styling
'!$AWS_DARK = true

!define AWSPuml https://raw.githubusercontent.com/awslabs/aws-icons-for-plantuml/v23.1/dist
!include AWSPuml/AWSCommon.puml
!include AWSPuml/AWSExperimental.puml
!include AWSPuml/General/User.puml
!include AWSPuml/General/SAMLtoken.puml
!include AWSPuml/SecurityIdentityCompliance/Cognito.puml
!include AWSPuml/SecurityIdentityCompliance/IdentityAccessManagementPermissions.puml
!include AWSPuml/SecurityIdentityCompliance/IdentityAccessManagementAWSSTSAlternate.puml
!include AWSPuml/SecurityIdentityCompliance/IdentityAccessManagementTemporarySecurityCredential.puml
!include AWSPuml/SecurityIdentityCompliance/IdentityAccessManagementRole.puml
!include AWSPuml/Storage/SimpleStorageServiceBucket.puml
!include AWSPuml/Storage/SimpleStorageServiceObject.puml

hide footbox
skinparam style strictuml

skinparam Sequence { 
    MessageAlignment left
}
skinparam Note {
  TextAlignment left 
  FontColor black
  BackgroundColor %lighten($AWS_COLOR_SMILE, 90)
}
skinparam WrapWidth 300
skinparam MaxMessageSize 600

!procedure $AWSIcon($service, $line1, $line2="")
participant "$AWSImg($service)\n<b>$line1</b>\n$line2"
!endprocedure 

$AWSIcon(User, " ", "User") as user <<Tenant 1>>
$AWSIcon(Cognito, "User Pool", "Amazon Cognito") as userpool
$AWSIcon(Cognito, "Identity Pool", "Amazon Cognito") as idpool
$AWSIcon(SimpleStorageServiceBucket, "Bucket", "Amazon S3") as s3 <<Multi-Tenant>>
$AWSIcon(IdentityAccessManagementAWSSTSAlternate, " ", "AWS STS") as sts
$AWSIcon(IdentityAccessManagementPermissions, "Policy", "AWS IAM") as permissions

note over userpool
  1. Authenticate and get tokens
end note
user -> userpool++ $AWSColor(SecurityIdentityCompliance): InitiateAuth
return ID Token and Access Token
note<<AWSIcon>> left
  $SAMLtokenIMG("0.5") $SAMLtokenIMG("0.5")
end note

note over idpool
  2. Exchange tokens for AWS credentials
end note
user -> idpool++ $AWSColor(SecurityIdentityCompliance): GetCredentialsForIdentity
idpool -> idpool: map to IAM Role
$AWSIconLeft(IdentityAccessManagementRole)
idpool -> sts++ $AWSColor(SecurityIdentityCompliance): AssumeRoleWithWebIdentity(Role)
return temporary security credentials
$AWSIconLeft(IdentityAccessManagementTemporarySecurityCredential)
return temporary security credentials
$AWSIconLeft(IdentityAccessManagementTemporarySecurityCredential)

note over s3
  3. Access AWS services with credentials
end note
user -> s3++ $AWSColor(Storage): GetObject
s3 -> permissions++ $AWSColor(SecurityIdentityCompliance): check permissions
alt no access
  permissions --> s3: ❌  Deny
  s3 --> user: error (AccessDenied)
else access
  return ✅  Allow
  return S3 object
  $AWSIconLeft(SimpleStorageServiceObject)
end

@enduml