I'm working on a AWS serverless app that will need to query SalesForce from AWS Lambdas to receive it's data and I'm struggling with how to authorize my Lambdas to talk to SalesForce.

Most of my research suggested that I should be using AWS VPC and Private Link to connect the two, but I can't find any details on what sort of VPC I should use.

For instance Scenario 2 of this article https://aws.amazon.com/blogs/apn/connecting-aws-and-salesforce-enables-enterprises-to-do-more-with-customer-data/ seems to be describing exactly what I want to do but is very vague on the details.

So far I've tried to set up a VPC using com.amazonaws.us-east-1.events for the service (I'm not sure if this is the correct service, but it make the most sense to me from the options I was given when trying to create a service) and I was able to use this service to create an endpoint.

I'm also sure where to enter the SalesForce authorization information. And I would assume I need to do something on the SalesForce's end like create a Connected App.

Am I on the right track here? Or should I just be trying to get an OAuth2 token from SalesForce that my Lambdas will use to connect? Or do I need to do both?

EDIT: So it turns out VPC was not the way to go since this is a serverless app. It's possible it might work wonders if I had an EC2 instance but I don't. I just wasn't hitting the authorization endpoint correctly.


Disclaimer: I'm not at all familiar with Amazon's cloud offerings (other than the pricing model being very convoluted)

As far as the Salesforce side of the equation is concerned, you're on the right track. You'll need to create your own connected app with the permissions (also called OAuth scopes) indicated in that article:
Perform requests on your behalf, Access your basic information, and Access and manage your data.

After you create the connected app in Salesforce, you'll have access to the pieces of information that your VPC endpoint requires, namely the consumer key and consumer secret. To (try to) be clear, the thing that requires the information from your connected app is the VPC endpoint on the Amazon side of things.

The VPC endpoint from your linked article is the thing that does the heavy lifting for OAuth (things like constructing the OAuth request, storing the resulting access token, sending that access token in subsequent requests, and managing the refresh token). You shouldn't need to perform any of the steps in any of the OAuth flows yourself, and it sounds like following your linked article should mean that Amazon takes care of wiring your lambda and endpoint together.

  • Thanks, it helps to know I'm on the right track. Sadly however it's the Amazon side of things I can't seem to find any good documentation on and has me completely stumped. But at least I know I'm stumped on the right stuff. – Alexis Bell Dec 31 '18 at 22:04

I was also stuck with this for around 3 days and I found out what needs to be done is give add permissions from AWS CLI. I did the following using Mac

There are 2 permissions that need to be given:

  1. Amazon Lambda permission to use the DynamoDB and Cloudwatch Logs services.  

    1. For this create a policy from IAM User section and name it myLambda 
    2. Then copy paste the JSON code in JSON section and save this policy

    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:UpdateItem" ], "Resource": "arn:aws:dynamodb:ap-northeast-1:YOUR_ID:table/HolidaysList2019" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:ap-northeast-1:YOUR_ID:" }, { "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "" } ] }

    NOTE: Change the table name “HolidaysList2019” to your table name in DynamoDB and Id “YOUR_ID” to your AWS Id found in AWS Account section.  

    1. Finally attach this policy to the newly created Role for the particular Amazon Lambda Function.
  2. Add permission for allowing the Amazon Connect to be able to invoke the Amazon Lambda Function that you have created.

    1. Download AWS CLI and then aws configure from terminal

    2. Add the access key, secret key after generating from Security Credentials in Amazon Connect Console, then region as ap-northeast-1, document as json

    3. Then the following command

      aws lambda add-permission --function-name function:holidaysCheck --statement-id 1 --principal connect.amazonaws.com --action lambda:InvokeFunction --source-account YOUR_ID --source-arn arn:aws:connect:ap-northeast-1:YOUR_ID:instance/cbfwe5a0-ece7-e555-r555-7999777555a5 --region ap-northeast-1

    NOTE: Replace the function name “holidaysCheck”, Id “YOUR_ID” of account and instance ID "cbfwe5a0-ece7-e555-r555-7999777555a5" of Amazon Connect found in instance section from Amazon Console Also please change the region ap-northeast-1 to your region

This was done to use Amazon Lambda function in Amazon Connect and Salesforce was not used, but if you use Salesforce, you can follow the documentation for Salesforce Connected Apps and it should work!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.