15

I am building Alexa Skill for Google calendar. The client side code works as expected on local machine because I can authenticate the local machine using the link. But, when I deploy the code on AWS Lambda there is no way that I can authenticate as I cannot input code via AWS console.

I am getting trouble in setting up authentication of Google Calendar API when deployed on AWS lambda.

This documentation doesn't help much to me Google Implementing Server Side Authentication

Incpetor
  • 1,293
  • 6
  • 25
  • 46

5 Answers5

9

You should create a service account. Those are designed especially for server-to-server communication. Documentation can be found here: https://developers.google.com/identity/protocols/OAuth2ServiceAccount

The problems with the solutions from other answers are:

  • API keys are insecure
  • Access tokens (e.g. obtained by the CLI command gcloud auth print-access-token) expire. Since Lambdas are stateless, there's no way to store a token temporarily and refresh it when it's expired.
Bart Kummel
  • 662
  • 12
  • 18
3

I know this is late, but after struggling a lot with this problem, I found a solution. Do google auth with JWT

const {google} = require('googleapis');


const key ={
 client_email: process.env.CLIENT_EMAIL,
 private_key: process.env.PRIVATE_KEY,
}

const auth = new google.auth.JWT(
  key.client_email,
  null,
  key.private_key,
  ["https://www.googleapis.com/auth/analytics.readonly"],
  null
);

google.options({auth});
Danilo Sampaio
  • 41
  • 6
2

I have multiple lambdas depending a the same google credentials and token.

I store my credentials either in S3 or in DynamoDB.

My solution was to create a scheduled lambda function that refreshes the oAuth token every 55minutes. This prevents unnecessary refreshes if multiple lambdas where to run at the same time.

Altus
  • 1,315
  • 3
  • 11
  • 19
0

You have to do 2 steps specified in here, if you follow correctly you will get this done.

First, (only the first time) you need to set up your project and download the GOOGLE APPLICATION CREDENTIALS you will result with one json file with auth information inside, lets suppose you call it project.json

Now you will need to execute some commands to get access tokens, download and install Cloud SDK to have access to those commands.

 gcloud auth activate-service-account --key-file=/home/panchicore/project.json

then

gcloud auth print-access-token

you will get your key at this point, now we can use it in the next step:

Second, Make a Translation API request: (how I did it and tested with python requests)

import requests

key = "KEY GOT WITH gcloud auth print-access-token"

headers = {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer {}'.format(key)
}

url = 'https://translation.googleapis.com/language/translate/v2'

data = {
  'q': 'The quick brown fox jumped over the lazy dog.',
  'source': 'en',
  'target': 'es',
  'format': 'text'
}

res = requests.post(url, json=data, headers=headers)

print res.content
>>> El rápido zorro marrón saltó sobre el perro perezoso.

Hope it helps.

panchicore
  • 11,451
  • 12
  • 74
  • 100
  • 3
    Will that token be good forever, or only for a limited amount of time? – NealWalters Dec 01 '17 at 23:31
  • not before, now they expire and the date comes with the `gcloud` reponse. – panchicore Jan 31 '18 at 14:59
  • Bart, this is disclaimed in my previous comment. – panchicore Jul 13 '18 at 10:09
  • @panchicore, tried your solution. As said, worked for sometime and then key expired. Do you have a solution to generate auth token for Lambda function without import google cloud sdk? – sheenu85 Aug 08 '18 at 04:42
  • 2
    2 ways: the correct one: Obtain an access token from the Google Authorization Server. https://developers.google.com/identity/protocols/OAuth2. and the crafted one: bash script that runs the routine getting the key with `gcloud auth print-access-token` and posting it to a secure dynamodb table with the expiration flag, that flag is queried everytime by the cronjob running the script (basically acts as a cache). – panchicore Aug 08 '18 at 08:59
-1

The easier way is using api keys to authenticate. https://cloud.google.com/docs/authentication/api-keys

You can make requests to some google apis like this (javascript)

const request = require('request')
request.post(`https://language.googleapis.com/v1beta2/documents:analyzeSentiment?key=${process.env.GOOGLE_API_KEY || ''}`, 
{
    json : true,
    body : {
        document : document
    }
},
(error, response, body) => {
    console.log(body)
})
clsource
  • 1
  • 1