(For more resources on SimpleDB, see here.)

Creating an AWS account

In order to start using SimpleDB, you will first need to sign up for an account with AWS.

Visit http://aws.amazon.com/ and click on Create an AWS Account.

You can sign up either by using your e-mail address for an existing Amazon account, or by creating a completely new account. You may wish to have multiple accounts to separate billing for projects. This could make it easier for you to track billing for separate accounts. After a successful signup, navigate to the main AWS page— http://aws.amazon.com/, and click on the Your Account link at any time to view your account information and make any changes to it if needed.

Enabling SimpleDB service for AWS account

Once you have successfully set up an AWS account, you must follow these steps to enable the SimpleDB service for your account:

1. Log in to your AWS account.
2. Navigate to the SimpleDB home page—http://aws.amazon.com/simpledb/.
3. Click on the Sign Up For Amazon SimpleDB button on the right side of the page.
4. Provide the requested credit card information and complete the signup process.

   

You have now successfully set up your AWS account and enabled it for SimpleDB.

All communication with SimpleDB or any of the Amazon web services must be through either the SOAP interface or the Query/ReST interface. The request messages sent through either of these interfaces is digitally signed by the sending user in order to ensure that the messages have not been tampered within transit, and that they really originate from the sending user. Requests that use the Query/ReST interface will use the access keys for signing the request, whereas requests to the SOAP interface will use the x.509 certificates.

Your new AWS account is associated with the following items:

• A unique 12-digit AWS account number for identifying your account.
• AWS Access Credentials are used for the purpose of authenticating requests made by you through the ReST Request API to any of the web services provided by AWS. An initial set of keys is automatically generated for you by default. You can regenerate the Secret Access Key at any time if you like. Keep in mind that when you generate a new access key, all requests made using the old key will be rejected.
  • An Access Key ID identifies you as the person making requests to a web service.
  • A Secret Access Key is used to calculate the digital signature when you make requests to the web service.
  • Be careful with your Secret Access Key, as it provides full access to the account, including the ability to delete all of your data.

  

• All requests made to any of the web services provided by AWS using the SOAP protocol use the X.509 security certificate for authentication. There are no default certificates generated automatically for you by AWS. You must generate the certificate by clicking on the Create a new Certificate link, then download them to your computer and make them available to the machine that will be making requests to AWS.
  • Public and private key for the x.509 certificate. You can either upload your own x.509 certificate if you already have one, or you can just generate a new certificate and then download it to your computer.

  

Query API and authentication

There are two interfaces to SimpleDB. The SOAP interface uses the SOAP protocol for the messages, while the ReST Requests uses HTTP requests with request parameters to describe the various SimpleDB methods and operations. In this book, we will be focusing on using the ReST Requests for talking to SimpleDB, as it is a much simpler protocol and utilizes straightforward HTTP-based requests and responses for communication, and the requests are sent to SimpleDB using either a HTTP GET or POST method.

The ReST Requests need to be authenticated in order to establish that they are originating from a valid SimpleDB user, and also for accounting and billing purposes. This authentication is performed using your access key identifiers. Every request to SimpleDB must contain a request signature calculated by constructing a string based on the Query API and then calculating an RFC 2104-compliant HMAC-SHA1 hash, using the Secret Access Key.

The basic steps in the authentication of a request by SimpleDB are:

• You construct a request to SimpleDB.
• You use your Secret Access Key to calculate the request signature, a Keyed-Hashing for Message Authentication code (HMAC) with an SHA1 hash function.
• You send the request data, the request signature, timestamp, and your Access Key ID to AWS.
• AWS uses the Access Key ID in the request to look up the associated Secret Access Key.
• AWS generates a request signature from the request data using the retrieved Secret Access Key and the same algorithm you used to calculate the signature in the request.
• If the signature generated by AWS matches the one you sent in the request, the request is considered to be authentic. If the signatures are different, the request is discarded, and AWS returns an error response. If the timestamp is older than 15 minutes, the request is rejected.

The procedure for constructing your requests is simple, but tedious and time consuming. This overview was intended to make you familiar with the entire process, but don’t worry—you will not need to go through this laborious process every single time that you interact with SimpleDB. Instead, we will be leveraging one of the available libraries for communicating with SimpleDB, which encapsulates a lot of the repetitive stuff for us and makes it simple to dive straight into playing with and exploring SimpleDB!