Introduction to RISC V and Assembly Language for Beginners

Bahadir Balban — Wed, 11 Mar 2020 17:40:18 +0000

Learn what RISC V is, and basic assembly language in 15 minutes

This is a gentle introduction to the RISC V open source instruction set architecture (ISA) for beginners.

I covered how RISC V started, what the ISA is about, how assembly instructions work.

The 15 minute session ends with a simple applied lab that you can conduct on a PC at home.

At Tech Buzz I share quick videos and articles that get you up to speed on a new industrial subject, and enable you to build things.

If you are interested in industrial tutorials feel free to check out Tech Buzz

If people are interested I will produce more of this series. Join the RISCV course community here

Cheers!
Bahadir

How to divide an S3 bucket with per-customer paths and enable secure file access

Bahadir Balban — Thu, 20 Jun 2019 23:22:01 +0000

Summary

You can divide a single S3 bucket into per-customer paths, and allow those customers to control read or write access, only to their own /username path. You do this by giving each customer an AWS IAM user and attaching a policy that lets them only access their /username path.

Customers can do accelerated uploads using signed S3 urls, and make their files available to public temporarily and securely (e.g. behind a paywall).

Use case: You host web apps for others, whose customers sign up to their service, and download a file they purchased from your customer’s signed S3 url. The file is hosted on your S3 bucket.

If you want to go one step further and let users make available their files for download via a CDN, it is not instantly supported by Cloudfront. This is because each user has their own keys to their /username path, but Cloudfront has one master key. You can’t generate a per-user Cloudfront key for a single S3 bucket the way you generate IAM keys. There is a hack for this shared below as well, or simpler: just use signed S3 urls for downloads.

Details

While building SaaSBox, I needed to create a storage hosting solution where each customer has access to their own files, for read and write. I needed a simple solution that works well for many users. I ended up with a single S3 bucket, dividing it into customer paths starting with /username.

Here is how it works:

Set up a single s3 bucket. Each time a new user/customer signs up, you create a new IAM user in AWS, attaching the following policy to the user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowGroupToSeeBucketListInTheConsole",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "AllowRootAndHomeListingOfCompanyBucket",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my-s3-bucket-name"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:prefix": [
                        "",
                        "/"
                    ],
                    "s3:delimiter": [
                        "/"
                    ]
                }
            }
        },
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my-s3-bucket-name"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${aws:username}/*",
                        "${aws:username}"
                    ]
                }
            }
        },
        {
            "Sid": "AllowAllS3ActionsInUserFolder",
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my-s3-bucket-name/${aws:username}/*"
            ]
        }
    ]
}

The policy has the ${aws:username} placeholder, which means, it applies to each IAM user with the policy attached.

TIP: Make sure to also tag IAM users when creating them so that you know these are users of your service.

NOTE: You must attach the policy to the IAM user, not the S3 Bucket.

Making S3 content private and only available via signed urls

What you want to achieve is that your S3 bucket contents are always private, except:

When your users want to, they should be able to write to their directory.

They should be able to make their files public for download whenever needed (in my case right after they sell them).

You achieve this using signed urls. S3 buckets support signed urls for upload and download. Here is the code you need in order to generate signed urls:

S3 Signed url for reading:

/* S3 signed url for reading */
exports.get_file_read_presigned_url = function(fpath, ftype) {
    const url = s3.getSignedUrl('getObject', {
        Bucket: s3bucket.url,
        Key: fpath,
        ResponseContentType: ftype
    });
    return url;
}

S3 Signed url for writing:

/* S3 signed url for uploading files */
exports.get_file_upload_presigned_url = function(fpath, ftype) {
    console.log("s3bucket.url:", s3bucket.url)
    const url = s3.getSignedUrl('putObject', {
        Bucket: s3bucket.url,
        Key: fpath,
        ACL: 'authenticated-read',
        ContentType: ftype
    });
    return url;
}

Using Cloudfront CDN for caching files

Instead of an S3 signed url for reading, ideally you should set up cloudfront on the S3 bucket and sign urls using cloudfront. Here is how you would normally achieve this for your own files.

const signer = new AWS.CloudFront.Signer(s3bucket.cf_accessKeyId, s3bucket.cf_privateKey);
const twoDays = 2*24*60*60*1000

/* Cloudfront signed url for reading */
exports.get_file_read_presigned_url = function(fpath, ftype ) {
    const signedUrl = signer.getSignedUrl({
        url: s3bucket.cdn_url + "/" + fpath,
        expires: Math.floor((Date.now() + twoDays)/1000), // Unix UTC timestamp for now + 2 days
    })
    return signedUrl;
}

At this point, you can do accelerated uploads to S3 by using S3 signed urls for upload, and cloudfront for making them available for read.

However, serving files via Cloudfront signed by your customers' keys is not an immediately possible approach.

Fine grain access to S3 files using per-user paths by your users with Cloudfront enabled

This is something I wanted to achieve, e.g. if I can create IAM users with per user directory access on the S3 bucket with their own keys, I would also want to serve their files using a CDN such as cloudfront, with them signing the urls using their keys.

Unfortunately this is not immediately supported by Cloudfront. E.g. the use case is you create some master key for Cloudfront using your AWS root account and make available all files signing with your key.

If you want your users to make available their own directory path on the S3 bucket using their own keys, it is not possible with Cloudfront, since you have 1 master key.

The simple solution is just use S3 signed urls without cloudfront. You can serve thousands of users on a single s3 bucket!

There is a workaround to using Cloudfront though and it is described at this link: How to use S3 signed urls with Cloudfront.

CloudFront Workaround

By nature, S3 signed urls change each time they are generated. As a result, each new url means re-caching by Cloudfront, defeating the purpose of having a cache. Therefore what you do is, you force/hack the S3 signed url generation function to generate the same url for a period of time, fixing the time element artificially to a window. E.g. for the current hour + 1 hour, tell it to generate this specific url only. This way CF can cache the url for that period.

If you directly generate the URL via CloudFront you don’t have this problem since Cloudfront has direct access to the file.

But yes you can do it, by fixating the generated url by S3, and re-caching the file every few hours.

Learn back-end development with Node.js and Express with this free in-depth course (2.5 hours)

Bahadir Balban — Fri, 15 Feb 2019 19:54:29 +0000

This course☝️ starts from scratch and shows you how to build a landing page, collect and manage sales leads developing an application using the CRUD pattern (create, update, delete). We develop an MVC style application with models, views, routes, controllers. If you are new to backend development and Nodejs this course is made for you.


CRUD snippet from the tutorial

Topics covered include user sign up, login with PassportJS, installing and creating basic tables in PostgreSQL, issuing queries using the Sequelize ORM, what a middleware is and implementing user access control using middleware, form validation, how to divide your views using pug mixins and more.


Implementing form validations - snippet from the tutorial

Tutorial site with videos split into 28 lessons

Here is more content about this tutorial. If you liked the tutorial, join our Learning Express group free for updates, Q&A, source code and more: https://getbuzz.io/o/learning-expressjs/u/join-open-access

I believe learning should be free and fast.

Fast as in:

There are no enrollment hops until you reach a course. It starts immediately, online.
Videos make their point right away. They are short and concise.
And Fun: Learning must be fun, e.g. not solitary but a social activity.

For these reasons I am building Tech Buzz, a site for learning tech fast and free, - now focusing on tech areas towards building an online business.

Update: Launching an online software service shouldn't be hard.

So I took this tutorial some steps further to build SaaSBox. It lets you launch an online web application / SaaS about 4 weeks faster.

OK we have to have a title then.

Bahadir Balban — Tue, 10 Oct 2017 16:25:50 +0000

DEV Community: Bahadir Balban