5

It seems as though an AppSync project can only be configured with one Authorization type (API_KEY, AWS_IAM, etc.). I'm using AMAZON_COGNITO_USER_POOLS as my primary type, but I also have a (Node.js) client that I want to provision with API_KEY access.

Is this possible?

If not, can you suggest any alternatives?

jsleeuw
  • 283
  • 5
  • 13
  • See answer below; AWS AppSync has added support for multiple authorization types in the same API. https://aws.amazon.com/blogs/mobile/using-multiple-authorization-types-with-aws-appsync-graphql-apis/ – parkerfath May 21 '19 at 23:34

3 Answers3

2

The answer by Rohan works provided you don't have subscriptions; if you do have a subscription in one AppSync endpoint and mutate data in another AppSync endpoint then while the data behind the scenes is updated, the subscription won't update (which makes sense, as the subscription is a attached as a listener within an AppSync endpoint). Until AppSync supports multiple methods you might want to give IAM a try; there's some details here on how to get it to work with Cognito in app + a Lambda. The example there is in python but for node.js you would generate signatures with something like https://www.npmjs.com/package/aws4 . The same method would work if running your node.js client elsewhere provided you generate some API keys

Matthew Berryman
  • 146
  • 2
  • Thanks very much Matthew, this is very helpful. Yes, I did encounter the issue with subscriptions, which is a problem for me. I'll take a good look at the links provided. Again, thanks! – jsleeuw Jul 11 '18 at 12:14
1

There are two approaches to solve for your use case.

  1. You can provision a separate AppSync endpoint (you can create up to 25 per region within an AWS account) with the same schema and configure it with a different authorization scheme. Use this approach only if you need hard isolation between the endpoints.

  2. As of May 2019, AWS AppSync supports multiple authorization schemes for a GraphQL API. You can enable AMAZON_COGNITO_USER_POOLS as the default auth scheme and API_KEY as the additional auth scheme. This is the recommended approach and also works with subscriptions, which addresses Matthew’s concern in another answer.

Rohan Deshpande
  • 3,535
  • 1
  • 26
  • 31
  • Thanks Rohan, that's an interesting idea. Will give it a try. Please allow me a "+1" for the ability to have more than one auth schema per AppSync endpoint in the future! – jsleeuw Jul 05 '18 at 18:59
  • This really should be a feature request. There are cases where multiple configs are needed for the same endpoint. – Stephen Brickner Dec 14 '18 at 15:42
1

As of May 2019, AWS AppSync announced the support for multiple auth types in the same API. https://aws.amazon.com/blogs/mobile/using-multiple-authorization-types-with-aws-appsync-graphql-apis/

parkerfath
  • 1,648
  • 1
  • 12
  • 18