fix: fix appsync permission assignment from functions

packages/amplify-category-api/src/provider-utils/awscloudformation/service-walkthroughs/appSync-walkthrough.ts

@@ -53,9 +53,10 @@ export const openConsole = async (context: $TSContext) => {
   const graphQLApis = Object.keys(categoryAmplifyMeta).filter(resourceName => {
     const resource = categoryAmplifyMeta[resourceName];
 
-    return resource.output &&
-      (resource.service === serviceName ||
-        (resource.service === elasticContainerServiceName && resource.apiType === 'GRAPHQL'))
+    return (
+      resource.output &&
+      (resource.service === serviceName || (resource.service === elasticContainerServiceName && resource.apiType === 'GRAPHQL'))
+    );
   });
 
   if (graphQLApis) {
@@ -64,17 +65,19 @@ export const openConsole = async (context: $TSContext) => {
 
     if (graphQLApis.length > 1) {
       ({ selectedApi } = await inquirer.prompt({
-        type: "list",
-        name: "selectedApi",
+        type: 'list',
+        name: 'selectedApi',
         choices: graphQLApis,
-        message: "Please select the API"
+        message: 'Please select the API',
       }));
     }
 
     const selectedResource = categoryAmplifyMeta[selectedApi];
 
     if (selectedResource.service === serviceName) {
-      const { output: { GraphQLAPIIdOutput } } = selectedResource;
+      const {
+        output: { GraphQLAPIIdOutput },
+      } = selectedResource;
       const appId = amplifyMeta.providers[providerName].AmplifyAppId;
       if (!appId) {
         throw new Error('Missing AmplifyAppId in amplify-meta.json');
@@ -92,31 +95,34 @@ export const openConsole = async (context: $TSContext) => {
         const baseUrl: string = providerPlugin.adminBackendMap[region].amplifyAdminUrl;
         url = `${baseUrl}/admin/${appId}/${envName}/datastore`;
       }
-
-    } else { // Elastic Container API
-      const { output: { PipelineName, ServiceName, ClusterName } } = selectedResource;
-      const codePipeline = "CodePipeline";
-      const elasticContainer = "ElasticContainer"
+    } else {
+      // Elastic Container API
+      const {
+        output: { PipelineName, ServiceName, ClusterName },
+      } = selectedResource;
+      const codePipeline = 'CodePipeline';
+      const elasticContainer = 'ElasticContainer';
 
       const { selectedConsole } = await inquirer.prompt({
-        name: "selectedConsole",
-        message: "Which console you want to open",
-        type: "list",
-        choices: [{
-          name: "Elastic Container Service (Deployed container status)",
-          value: elasticContainer
-        }, {
-          name: "CodePipeline (Container build status)",
-          value: codePipeline
-        }]
+        name: 'selectedConsole',
+        message: 'Which console you want to open',
+        type: 'list',
+        choices: [
+          {
+            name: 'Elastic Container Service (Deployed container status)',
+            value: elasticContainer,
+          },
+          {
+            name: 'CodePipeline (Container build status)',
+            value: codePipeline,
+          },
+        ],
       });
 
       if (selectedConsole === elasticContainer) {
-        url = `https://console.aws.amazon.com/ecs/home?region=${Region}#/clusters/${ClusterName}/services/${ServiceName}/details`
-
+        url = `https://console.aws.amazon.com/ecs/home?region=${Region}#/clusters/${ClusterName}/services/${ServiceName}/details`;
       } else if (selectedConsole === codePipeline) {
-        url = `https://${Region}.console.aws.amazon.com/codesuite/codepipeline/pipelines/${PipelineName}/view`
-
+        url = `https://${Region}.console.aws.amazon.com/codesuite/codepipeline/pipelines/${PipelineName}/view`;
       } else {
         context.print.error('Option not available');
         return;
@@ -126,8 +132,8 @@ export const openConsole = async (context: $TSContext) => {
     open(url, { wait: false });
   } else {
     context.print.error('AppSync API is not pushed in the cloud.');
-  };
-}
+  }
+};
 
 export const serviceWalkthrough = async (context: $TSContext, defaultValuesFilename, serviceMetadata) => {
   const resourceName = resourceAlreadyExists(context);
@@ -715,50 +721,16 @@ export const migrate = async context => {
   });
 };
 
-export const getIAMPolicies = (resourceName, crudOptions, context) => {
+export const getIAMPolicies = (resourceName, operations, context) => {
   let policy = {};
-  const actions = [];
-
-  crudOptions.forEach(crudOption => {
-    switch (crudOption) {
-      case 'create':
-        actions.push('appsync:Create*', 'appsync:StartSchemaCreation', 'appsync:GraphQL');
-        break;
-      case 'update':
-        actions.push('appsync:Update*');
-        break;
-      case 'read':
-        actions.push('appsync:Get*', 'appsync:List*');
-        break;
-      case 'delete':
-        actions.push('appsync:Delete*');
-        break;
-      default:
-        console.log(`${crudOption} not supported`);
-    }
-  });
+  const resources = [];
+
+  operations.forEach(operation => resources.push(buildPolicyResource(resourceName, operation)));
 
   policy = {
     Effect: 'Allow',
-    Action: actions,
-    Resource: [
-      {
-        'Fn::Join': [
-          '',
-          [
-            'arn:aws:appsync:',
-            { Ref: 'AWS::Region' },
-            ':',
-            { Ref: 'AWS::AccountId' },
-            ':apis/',
-            {
-              Ref: `${category}${resourceName}GraphQLAPIIdOutput`,
-            },
-            '/*',
-          ],
-        ],
-      },
-    ],
+    Action: ['appsync:GraphQL'],
+    Resource: resources,
   };
 
   const attributes = ['GraphQLAPIIdOutput', 'GraphQLAPIEndpointOutput'];
@@ -769,6 +741,25 @@ export const getIAMPolicies = (resourceName, crudOptions, context) => {
   return { policy, attributes };
 };
 
+const buildPolicyResource = (resourceName, operation) => {
+  return {
+    'Fn::Join': [
+      '',
+      [
+        'arn:aws:appsync:',
+        { Ref: 'AWS::Region' },
+        ':',
+        { Ref: 'AWS::AccountId' },
+        ':apis/',
+        {
+          Ref: `${category}${resourceName}GraphQLAPIIdOutput`,
+        },
+        `/types/${operation}/*`,
+      ],
+    ],
+  };
+};
+
 const templateSchemaFilter = authConfig => {
   const authIncludesCognito = getAuthTypes(authConfig).includes('AMAZON_COGNITO_USER_POOLS');
   return (templateOption: ListChoiceOptions): boolean =>

packages/amplify-category-function/src/constants.ts

@@ -12,3 +12,9 @@ export enum CRUDOperation {
   UPDATE = 'update',
   DELETE = 'delete',
 }
+
+export enum GraphQLOperation {
+  QUERY = 'Query',
+  MUTATION = 'Mutation',
+  SUBSCRIPTION = 'Subscription',
+}