Network.AWS.CloudFront.SignedCookies

Example usage:

{-# LANGUAGE OverloadedStrings, ScopedTypeVariables #-}

import Network.AWS.CloudFront.SignedCookies

import qualified Data.Text.IO

main :: IO ()
main = do

  -- Construct an IAM policy that expires three days from now
  policy :: Policy <- simplePolicy
    (Resource "https://example.com/secrets/*")
    (Lifespan (3 * nominalDay))

  -- Parse the .pem file to get the private key
  key :: PrivateKey <- readPrivateKeyPemFile
    (PemFilePath "./pk-APKAIATXN3RCIOVT5WRQ.pem")

  -- Construct signed cookies
  cookies :: CookiesText <- createSignedCookies
    (KeyPairId "APKAIATXN3RCIOVT5WRQ") key policy

  Data.Text.IO.putStrLn (renderCookiesText cookies)

Output:

Cookie: CloudFront-Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc29...
Cookie: CloudFront-Signature=wMN6V3Okxk7sdSPZeebMh-wo...
Cookie: CloudFront-Key-Pair-Id=APKAIATXN3RCIOVT5WRQ

You can see a very similar example in action in the Network.AWS.CloudFront.SignedCookies.CLI module.

Creating signed cookies

createSignedCookies

Arguments

:: KeyPairId

A CloudFront key pair ID, which must be associated with a trusted signer in the CloudFront distribution that you specify in the policyResource.

-> PrivateKey

The private key associated with the KeyPairId. See readPrivateKeyPemFile for how to read this key from a .pem file you downloaded from AWS.

-> Policy

The policy specifies what resource is being granted, for what time period, and to what IP addresses. Construct a policy using the Policy constructor or with the simplePolicy function.

-> IO CookiesText

Defining a CloudFront policy

simplePolicy

Arguments

:: Resource

URL that the policy will grant access to, optionally containing asterisks for wildcards

-> Lifespan

How long from now the credentials expire

-> IO Policy

This function provides one convenient way to construct a simple Policy.

For the full set of policy options, use the Policy constructor directly.

data Policy

A policy specifies what resource is being granted, for what time period, and to what IP addresses.

For AWS's documentation on what going into a CloudFront policy statement, see Values That You Specify in the Policy Statement for a Custom Policy for Signed Cookies.

Constructors

Policy

Fields

• policyResource :: Resource

  URL that the policy will grant access to, optionally containing asterisks for wildcards

• policyStart :: StartTime

  The time at which credentials begin to take effect

• policyEnd :: EndTime

  The time at which credentials expire

• policyIpAddress :: IpAddress

  The IP address or address range of clients allowed to make requests

Instances

Eq Policy

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: Policy -> Policy -> Bool

(/=) :: Policy -> Policy -> Bool

Show Policy

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> Policy -> ShowS

show :: Policy -> String

showList :: [Policy] -> ShowS

newtype Resource

URL that a policy will grant access to, optionally containing asterisks for wildcards.

Examples:

• "https://d123example.cloudfront.net/index.html"
• "https://d123example.cloudfront.net/*.jpeg"

Constructors

Resource Text

Instances

Eq Resource

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: Resource -> Resource -> Bool

(/=) :: Resource -> Resource -> Bool

Show Resource

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> Resource -> ShowS

show :: Resource -> String

showList :: [Resource] -> ShowS

newtype Lifespan

How long from now the credentials expire

Constructors

Lifespan NominalDiffTime

Instances

Eq Lifespan

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: Lifespan -> Lifespan -> Bool

(/=) :: Lifespan -> Lifespan -> Bool

Show Lifespan

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> Lifespan -> ShowS

show :: Lifespan -> String

showList :: [Lifespan] -> ShowS

data StartTime

The time at which credentials begin to take effect

Constructors

StartImmediately

StartTime POSIXTime

Instances

Eq StartTime

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: StartTime -> StartTime -> Bool

(/=) :: StartTime -> StartTime -> Bool

Show StartTime

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> StartTime -> ShowS

show :: StartTime -> String

showList :: [StartTime] -> ShowS

newtype EndTime

The time at which credentials expire

Constructors

EndTime POSIXTime

Instances

Eq EndTime

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: EndTime -> EndTime -> Bool

(/=) :: EndTime -> EndTime -> Bool

Show EndTime

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> EndTime -> ShowS

show :: EndTime -> String

showList :: [EndTime] -> ShowS

data IpAddress

The IP address or address range of clients allowed to make requests

Constructors

AnyIp

IpAddress Text

Instances

Eq IpAddress

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: IpAddress -> IpAddress -> Bool

(/=) :: IpAddress -> IpAddress -> Bool

Show IpAddress

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> IpAddress -> ShowS

show :: IpAddress -> String

showList :: [IpAddress] -> ShowS

Getting your private key

readPrivateKeyPemFile

Arguments

:: PemFilePath

The filesystem path of the .pem file

-> IO PrivateKey

Read an RSA private key from a .pem file you downloaded from AWS.

newtype PemFilePath

Location in the filesystem where a .pem file containing an RSA secret key can be found.

The filename downloaded from AWS looks like this:

• "pk-APKAIATXN3RCIOVT5WRQ.pem"

Constructors

PemFilePath Text

Instances

Eq PemFilePath

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: PemFilePath -> PemFilePath -> Bool

(/=) :: PemFilePath -> PemFilePath -> Bool

Show PemFilePath

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> PemFilePath -> ShowS

show :: PemFilePath -> String

showList :: [PemFilePath] -> ShowS

newtype KeyPairId

CloudFront key pair ID for the key pair that you are using to generate signature.

The key pair ID can be found in the name of key files that you download, and looks like this:

• APKAIATXN3RCIOVT5WRQ

Constructors

KeyPairId Text

Instances

Eq KeyPairId

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: KeyPairId -> KeyPairId -> Bool

(/=) :: KeyPairId -> KeyPairId -> Bool

Show KeyPairId

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> KeyPairId -> ShowS

show :: KeyPairId -> String

showList :: [KeyPairId] -> ShowS

data PrivateKey

Represent a RSA private key.

Only the pub, d fields are mandatory to fill.

p, q, dP, dQ, qinv are by-product during RSA generation, but are useful to record here to speed up massively the decrypt and sign operation.

implementations can leave optional fields to 0.

Instances

Eq PrivateKey

Defined in Crypto.PubKey.RSA.Types

Methods

(==) :: PrivateKey -> PrivateKey -> Bool

(/=) :: PrivateKey -> PrivateKey -> Bool

Data PrivateKey

Defined in Crypto.PubKey.RSA.Types

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> PrivateKey -> c PrivateKey

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c PrivateKey

toConstr :: PrivateKey -> Constr

dataTypeOf :: PrivateKey -> DataType

dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c PrivateKey)

dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c PrivateKey)

gmapT :: (forall b. Data b => b -> b) -> PrivateKey -> PrivateKey

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> PrivateKey -> r

gmapQr :: forall r r'. (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> PrivateKey -> r

gmapQ :: (forall d. Data d => d -> u) -> PrivateKey -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> PrivateKey -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> PrivateKey -> m PrivateKey

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> PrivateKey -> m PrivateKey

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> PrivateKey -> m PrivateKey

Read PrivateKey

Defined in Crypto.PubKey.RSA.Types

Methods

readsPrec :: Int -> ReadS PrivateKey

readList :: ReadS [PrivateKey]

readPrec :: ReadPrec PrivateKey

readListPrec :: ReadPrec [PrivateKey]

Show PrivateKey

Defined in Crypto.PubKey.RSA.Types

Methods

showsPrec :: Int -> PrivateKey -> ShowS

show :: PrivateKey -> String

showList :: [PrivateKey] -> ShowS

NFData PrivateKey

Defined in Crypto.PubKey.RSA.Types

Methods

rnf :: PrivateKey -> ()

Policy JSON

policyJSON :: Policy -> ByteString

Encode a Policy as JSON, with no whitespace, as AWS requires.

Excerpt from Setting Signed Cookies Using a Custom Policy:

• "Remove all whitespace (including tabs and newline characters) from the policy statement."

jsonTextPolicy :: Text -> Either String Policy

jsonValPolicy :: Value -> Either String Policy

Reading cookies

cookiePolicy :: PolicyCookie -> Either String Policy

Parse the text value of a CloudFront-Policy cookie into a Policy value, producing Left with an error message if parsing fails.

Miscellaneous

Cookies

type CookiesText = [(Text, Text)]

Textual cookies. Functions assume UTF8 encoding.

renderCookiesText :: CookiesText -> Text

Format a list of cookies as HTTP request headers.

newtype PolicyCookie

The value of a CloudFront-Policy cookie.

Constructors

PolicyCookie Text

Instances

Eq PolicyCookie

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: PolicyCookie -> PolicyCookie -> Bool

(/=) :: PolicyCookie -> PolicyCookie -> Bool

Show PolicyCookie

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> PolicyCookie -> ShowS

show :: PolicyCookie -> String

showList :: [PolicyCookie] -> ShowS

newtype SignatureCookie

The value of a CloudFront-Signature cookie.

Constructors

SignatureCookie Text

Instances

Eq SignatureCookie

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

(==) :: SignatureCookie -> SignatureCookie -> Bool

(/=) :: SignatureCookie -> SignatureCookie -> Bool

Show SignatureCookie

Defined in Network.AWS.CloudFront.SignedCookies.Types

Methods

showsPrec :: Int -> SignatureCookie -> ShowS

show :: SignatureCookie -> String

showList :: [SignatureCookie] -> ShowS

Time

data NominalDiffTime

This is a length of time, as measured by UTC. It has a precision of 10^-12 s.

Conversion functions will treat it as seconds. For example, (0.010 :: NominalDiffTime) corresponds to 10 milliseconds.

It ignores leap-seconds, so it's not necessarily a fixed amount of clock time. For instance, 23:00 UTC + 2 hours of NominalDiffTime = 01:00 UTC (+ 1 day), regardless of whether a leap-second intervened.

Instances

Enum NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

succ :: NominalDiffTime -> NominalDiffTime

pred :: NominalDiffTime -> NominalDiffTime

toEnum :: Int -> NominalDiffTime

fromEnum :: NominalDiffTime -> Int

enumFrom :: NominalDiffTime -> [NominalDiffTime]

enumFromThen :: NominalDiffTime -> NominalDiffTime -> [NominalDiffTime]

enumFromTo :: NominalDiffTime -> NominalDiffTime -> [NominalDiffTime]

enumFromThenTo :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime -> [NominalDiffTime]

Eq NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

(==) :: NominalDiffTime -> NominalDiffTime -> Bool

(/=) :: NominalDiffTime -> NominalDiffTime -> Bool

Fractional NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

(/) :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

recip :: NominalDiffTime -> NominalDiffTime

fromRational :: Rational -> NominalDiffTime

Data NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> NominalDiffTime -> c NominalDiffTime

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c NominalDiffTime

toConstr :: NominalDiffTime -> Constr

dataTypeOf :: NominalDiffTime -> DataType

dataCast1 :: Typeable t => (forall d. Data d => c (t d)) -> Maybe (c NominalDiffTime)

dataCast2 :: Typeable t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c NominalDiffTime)

gmapT :: (forall b. Data b => b -> b) -> NominalDiffTime -> NominalDiffTime

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> NominalDiffTime -> r

gmapQr :: forall r r'. (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> NominalDiffTime -> r

gmapQ :: (forall d. Data d => d -> u) -> NominalDiffTime -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> NominalDiffTime -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> NominalDiffTime -> m NominalDiffTime

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> NominalDiffTime -> m NominalDiffTime

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> NominalDiffTime -> m NominalDiffTime

Num NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

(+) :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

(-) :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

(*) :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

negate :: NominalDiffTime -> NominalDiffTime

abs :: NominalDiffTime -> NominalDiffTime

signum :: NominalDiffTime -> NominalDiffTime

fromInteger :: Integer -> NominalDiffTime

Ord NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

compare :: NominalDiffTime -> NominalDiffTime -> Ordering

(<) :: NominalDiffTime -> NominalDiffTime -> Bool

(<=) :: NominalDiffTime -> NominalDiffTime -> Bool

(>) :: NominalDiffTime -> NominalDiffTime -> Bool

(>=) :: NominalDiffTime -> NominalDiffTime -> Bool

max :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

min :: NominalDiffTime -> NominalDiffTime -> NominalDiffTime

Real NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

toRational :: NominalDiffTime -> Rational

RealFrac NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

properFraction :: Integral b => NominalDiffTime -> (b, NominalDiffTime)

truncate :: Integral b => NominalDiffTime -> b

round :: Integral b => NominalDiffTime -> b

ceiling :: Integral b => NominalDiffTime -> b

floor :: Integral b => NominalDiffTime -> b

Show NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

showsPrec :: Int -> NominalDiffTime -> ShowS

show :: NominalDiffTime -> String

showList :: [NominalDiffTime] -> ShowS

ToJSON NominalDiffTime

Defined in Data.Aeson.Types.ToJSON

Methods

toJSON :: NominalDiffTime -> Value

toEncoding :: NominalDiffTime -> Encoding

toJSONList :: [NominalDiffTime] -> Value

toEncodingList :: [NominalDiffTime] -> Encoding

FromJSON NominalDiffTime

This instance includes a bounds check to prevent maliciously large inputs to fill up the memory of the target system. You can newtype Scientific and provide your own instance using withScientific if you want to allow larger inputs.

Defined in Data.Aeson.Types.FromJSON

Methods

parseJSON :: Value -> Parser NominalDiffTime

parseJSONList :: Value -> Parser [NominalDiffTime]

NFData NominalDiffTime

Defined in Data.Time.Clock.Internal.NominalDiffTime

Methods

rnf :: NominalDiffTime -> ()

type POSIXTime = NominalDiffTime

POSIX time is the nominal time since 1970-01-01 00:00 UTC

To convert from a CTime or System.Posix.EpochTime, use realToFrac.

nominalDay :: NominalDiffTime

One day in NominalDiffTime.

getPOSIXTime :: IO POSIXTime

Get the current POSIX time from the system clock.

Text

data Text

A space efficient, packed, unboxed Unicode text type.

Instances

Hashable Text

Defined in Data.Hashable.Class

Methods

hashWithSalt :: Int -> Text -> Int

hash :: Text -> Int

ToJSON Text

Defined in Data.Aeson.Types.ToJSON

Methods

toJSON :: Text -> Value

toEncoding :: Text -> Encoding

toJSONList :: [Text] -> Value

toEncodingList :: [Text] -> Encoding

KeyValue Object

Constructs a singleton HashMap. For calling functions that demand an Object for constructing objects. To be used in conjunction with mconcat. Prefer to use object where possible.

Defined in Data.Aeson.Types.ToJSON

Methods

(.=) :: ToJSON v => Text -> v -> Object

KeyValue Pair

Defined in Data.Aeson.Types.ToJSON

Methods

(.=) :: ToJSON v => Text -> v -> Pair

ToJSONKey Text

Defined in Data.Aeson.Types.ToJSON

Methods

toJSONKey :: ToJSONKeyFunction Text

toJSONKeyList :: ToJSONKeyFunction [Text]

FromJSON Text

Defined in Data.Aeson.Types.FromJSON

Methods

parseJSON :: Value -> Parser Text

parseJSONList :: Value -> Parser [Text]

FromJSONKey Text

Defined in Data.Aeson.Types.FromJSON

Methods

fromJSONKey :: FromJSONKeyFunction Text

fromJSONKeyList :: FromJSONKeyFunction [Text]

Chunk Text

Defined in Data.Attoparsec.Internal.Types

Associated Types

type ChunkElem Text

Methods

nullChunk :: Text -> Bool

pappendChunk :: State Text -> Text -> State Text

atBufferEnd :: Text -> State Text -> Pos

bufferElemAt :: Text -> Pos -> State Text -> Maybe (ChunkElem Text, Int)

chunkElemToChar :: Text -> ChunkElem Text -> Char

Ixed Text

Defined in Control.Lens.At

Methods

ix :: Index Text -> Traversal' Text (IxValue Text)

AsNumber Text

Defined in Data.Aeson.Lens

Methods

_Number :: Prism' Text Scientific

_Double :: Prism' Text Double

_Integer :: Prism' Text Integer

AsPrimitive Text

Defined in Data.Aeson.Lens

Methods

_Primitive :: Prism' Text Primitive

_String :: Prism' Text Text

_Bool :: Prism' Text Bool

_Null :: Prism' Text ()

AsValue Text

Defined in Data.Aeson.Lens

Methods

_Value :: Prism' Text Value

_Object :: Prism' Text (HashMap Text Value)

_Array :: Prism' Text (Vector Value)

AsJSON Text

Defined in Data.Aeson.Lens

Methods

_JSON :: (FromJSON a, ToJSON b) => Prism Text Text a b

FromPairs Value (DList Pair)

Defined in Data.Aeson.Types.ToJSON

Methods

fromPairs :: DList Pair -> Value

v ~ Value => KeyValuePair v (DList Pair)

Defined in Data.Aeson.Types.ToJSON

Methods

pair :: String -> v -> DList Pair

type State Text

Defined in Data.Attoparsec.Internal.Types

type State Text = Buffer

type ChunkElem Text

Defined in Data.Attoparsec.Internal.Types

type ChunkElem Text = Char

type Item Text

Defined in Data.Text

type Item Text = Char

type Index Text

Defined in Control.Lens.At

type Index Text = Int

type IxValue Text

Defined in Control.Lens.At

type IxValue Text = Char