regression on appsync permission assignment from functions

[thibaultdalban]

Describe the bug
Since PR #5342 requesting a graphQL API inside a lambda using IAM auth returns a Permission denied.
errors: [{ errorType: 'UnauthorizedException', message: 'Permission denied' }]
Manually reverting the appsync policy in the lambda cloudformation template to the one generated before PR #5342 fix the issue.

Amplify CLI Version
4.42.0

Permissions generated in the cloudformation template

 {
              "Effect": "Allow",
              "Action": [
                "appsync:GraphQL"
              ],
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:appsync:",
                      {
                        "Ref": "AWS::Region"
                      },
                      ":",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":apis/",
                      {
                        "Ref": "apixxxGraphQLAPIIdOutput"
                      },
                      "/types/create/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:appsync:",
                      {
                        "Ref": "AWS::Region"
                      },
                      ":",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":apis/",
                      {
                        "Ref": "apixxxGraphQLAPIIdOutput"
                      },
                      "/types/read/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:appsync:",
                      {
                        "Ref": "AWS::Region"
                      },
                      ":",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":apis/",
                      {
                        "Ref": "apixxxGraphQLAPIIdOutput"
                      },
                      "/types/update/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:appsync:",
                      {
                        "Ref": "AWS::Region"
                      },
                      ":",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":apis/",
                      {
                        "Ref": "apixxxGraphQLAPIIdOutput"
                      },
                      "/types/delete/*"
                    ]
                  ]
                }
              ]
            }

Permissions manually updated in the cloudformation template

           {
              "Effect": "Allow",
              "Action": [
                "appsync:Create*",
                "appsync:StartSchemaCreation",
                "appsync:GraphQL",
                "appsync:Get*",
                "appsync:List*",
                "appsync:Update*"
              ],
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:appsync:",
                      {
                        "Ref": "AWS::Region"
                      },
                      ":",
                      {
                        "Ref": "AWS::AccountId"
                      },
                      ":apis/",
                      {
                        "Ref": "apixxxGraphQLAPIIdOutput"
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            }

This is how the request is signed in the lambda function:

  let signer = new AWS.Signers.V4(req, "appsync", true)
  signer.addAuthorization(AWS.config.credentials, AWS.util.date.getDate())

[thibaultdalban]

@r0zar thanks for the great job done on these permissions assignment 👍
Do you have any clues on why I have permission denied?

[r0zar]

Looks like the type mappings are wrong.

"/types/create/*" / "/types/read/*" / "/types/update/*" / "/types/delete/*"

For a workaround try setting your CF template to this:

{
  "Effect": "Allow",
  "Action": [
    "appsync:GraphQL"
  ],
  "Resource": [
    {
      "Fn::Join": [
        "",
        [
          "arn:aws:appsync:",
          {
            "Ref": "AWS::Region"
          },
          ":",
          {
            "Ref": "AWS::AccountId"
          },
          ":apis/",
          {
            "Ref": "apixxxGraphQLAPIIdOutput"
          },
          "/*"
        ]
      ]
    }
  ]
}

[thibaultdalban]

Thanks for your quick reply, I will give it a try and let you know.

[r0zar]

Thoughts on this issue...

Amplify allows for limiting create/read/write/update access to AppSync through a CLI based question-answer workflow.
(The PR updates it to use query/subscription/mutation language)

To implement that, the cloudformation policy is split into separate resource inputs which each are responsible for different resolver ARNs wildcard-paths.

You can get a better idea of the structure of the resolver ARNs by looking at your amplify/backend/api/<api-name>/build/cloudformation-template.json file an see how they are referenced by the generated AppSync code.

Resolver ARNs are being matched against using the implicit pattern that AppSync uses when it generates the resolvers. (Could be improved by exporting resolvers from the API category cloudformation and importing it elsewhere)

I'm not sure why the resources in your example are using the old create/read/update/delete language. The goal of the PR was to remove the CRUD verbs with the introduction of graphql-style language (query/mutation/subscription) for graphql-based APIs. This simplified the mapping of actions to relevant resolver ARN paths.

Todos

• Find out why CRUD verbs are being used for a AppSync API
• Look into possibility of exporting resolvers to use their ARNs by import/reference
• TBD

[thibaultdalban]

If it can help, the API has been created a few months ago, so not with the CLI V4.42.

[thibaultdalban]

I confirm it works

Looks like the type mappings are wrong.

"/types/create/*" / "/types/read/*" / "/types/update/*" / "/types/delete/*"

For a workaround try setting your CF template to this:

{
  "Effect": "Allow",
  "Action": [
    "appsync:GraphQL"
  ],
  "Resource": [
    {
      "Fn::Join": [
        "",
        [
          "arn:aws:appsync:",
          {
            "Ref": "AWS::Region"
          },
          ":",
          {
            "Ref": "AWS::AccountId"
          },
          ":apis/",
          {
            "Ref": "apixxxGraphQLAPIIdOutput"
          },
          "/*"
        ]
      ]
    }
  ]
}

[SwaySway]

Hello @thibaultdalban
This new feature has a feature flag for it did you have that enabled when running update? Labeling this as a docs issues to update the docs on this feature flag.

"appSync": {
  "generateGraphQLPermissions": true
}

[thibaultdalban]

@SwaySway I will check that tomorrow morning, in which file this flag is supposed to be defined?
I was reading the PR and discovered the check on this feature flag here so it's probably my issue. I will let you know.

[SwaySway]

Yup this feature flag can be assigned in the cli.json file which is located in your amplify dir.
More docs on FF here: https://docs.amplify.aws/cli/reference/feature-flags

[sevenseat]

After upgrading to 4.43.0, I had this issue as well. I did not originally have the generateGraphQLPermissions flag set, but I set it after reading the thread. The issue didn't disapper. To get things back to working, I followed @r0zar 's instructions above, setting the permissions to /*

[ataibarkai]

I'm also experiencing the same issue.

For anyone on the amplify team looking into this, this comment on another github issue sums up the problem perfectly:
#6675 (comment)

Seems it should be very easy to fix

[SwaySway]

Closing in favor of #6675

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels for those types of questions.