Blog

<?xml version="1.0" encoding="UTF-8"?>
  <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
            <CORSRule>
                <AllowedOrigin>*</AllowedOrigin>
                <AllowedMethod>POST</AllowedMethod>
                <AllowedMethod>GET</AllowedMethod>
                <AllowedMethod>PUT</AllowedMethod>
                <AllowedMethod>DELETE</AllowedMethod>
                <AllowedMethod>HEAD</AllowedMethod>
                <AllowedHeader>*</AllowedHeader>
            </CORSRule>
 </CORSConfiguration>

2. In Cognito Console Set User Pool:

Manage User Pools > Custom settings > Name Pool "TestPool" > "sign themselves up?" only administrator > No verification (nor email nor phone) > App clients > Add an app client > "TestPoolApp" > check "generate client secret" > Note down pool id and ARN , App client id and app client secret.

3. In Cognito Console Set Federated Identities:

Click on "Federated Identities" > Name "Identity pool name" > In "Authentication providers" > "cognito" tab > Set details of prev step. > "Custom" tab set developer name. > Create > Edit your `Auth_Role` > Set following:
{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
     "mobileanalytics:PutEvents",
     "cognito-sync:*",
     "cognito-identity:*"
    ],
   "Resource": [
     "*"
    ]
  },
 {
 "Effect": "Allow",
 "Action": [
    "s3:GetObject",
    "s3:PutObject"
  ],
 "Resource": [
   "arn:aws:s3:::<yourbucketname>/${cognito-identity.amazonaws.com:sub}/*"
   ]
  }
 ]
}
Note : With this user can upload files to only directory key named with its identity id.

4. Get ARN of above auth rule and also Note down identity pool id.

Now you can create api that can return identity id and token so client sdk can upload to s3 directly.

sudo apt-get update
sudo apt-get install python-pip ruby wget
cd /home/ubuntu
wget https://aws-codedeploy-<<bucket-region>>.s3.amazonaws.com/latest/install
chmod +x ./install
sudo ./install auto
sudo service codedeploy-agent start
sudo systemctl enable codedeploy-agent

2. Create Tag in your EC2.

Select Instance > Tags tab

- Create role > From AWS Service Role > Select "AWS CodeDeploy" > Name it "codedeploy_service_role"
- Again Open that "codedeploy_service_role" and Attach policies > "AWSCodePipelineFullAccess"

- Create Policy > "Create Your Own Policy" > Name it "CodeDeployEC2" >
  {
    "Version": "2012-10-17",
    "Statement": [
      {
       "Action": [
         "s3:Get*",
         "s3:List*"
       ],
       "Effect": "Allow",
       "Resource": "*"
     }
    ]
  }
- Save it.

- Create Role > From AWS Service Role > Select "Amazon EC2" > From policies search above and select it > Name it "EC2CodeDeployRole"

- Select Instance > Action > Instance Settings > Attach Replace IAM Roles > Select "EC2CodeDeployRole"

- This file contains your before deploy (ex git clone, pull) and after deploy (running db migrations, restart server) bash scripts locations. so create them. and push to your deploy branch.

- Select "Custom deployment" > Provide Application Name and group name > Select "In-place deployment" > Select your EC2 tag that created earlier > Select "OneAtTime" configuration > Select "codedeploy_service_role" in Service Role > Create.

- Name it > Source Location > Github > Connect it (will need org permission) and you must be owner of repo > Select repo > deploy branch > In Build provider "No build" > In Deployment provider "AWS CodeDeploy" > Select app name and deploy group name created in prev step > In AWS Service Role "Create New Role" > Create Pipeline