CODEWITHSUNDEEP
graphqlaws-amplify
Min
Min

Reputation: 538

How to give separate permissions to GraphQL queries in AWS Amplify

I need to give separate permissions to separate GraphQL queries. For example, currently I have defined two queries @auth gives permission to Admin group to these two queries. How can I give access to any logged in user(Cognito Pools) to invokeLambda query and only Admin group to invokeGetGroups query ? I can't seem to figure out how it is done.

type Query {
  @auth(
      rules: [
        { allow: groups, groups: ["Admins"] }])
  invokeLambda: String @function(name: "pythonLambda-${env}") 
  invokeGetGroups: String @function(name: "getPatchGroups-${env}")
}

Upvotes: 0

Views: 334

Answers (1)

Cabemo
Cabemo

Reputation: 36

You can use the @auth rule within each function as so:

type Query {
  invokeLambda: String
    @function(name: "pythonLambda-${env}")
    @auth(rules: [{allow: private, provider: userPools}])
  invokeGetGroups: String
    @function(name: "getPatchGroups-${env}")
    @auth(rules: [{allow: groups, groups: ["Admins"]}])

}

I haven't tried it with different auth rules, but I did try with the same auth rules on each function when I was following an AWS tutorial.

Upvotes: 1

Related Questions