With AWS Amplify Auth and GraphQL API, how would you have some public, and some private query/mutation calls?

Question

Setup:

• AWS Amplify API w/ GraphQL
• AWS Amplify Auth w/ Cognito User Pools

Say the majority of the platform should be accessible by a logged out user. Eg they should be able to read forum Topics , but if they want to post, they need to sign in.

I see an @auth resolver that I can use, but whenever I try to make a graphQL call to my.url.amazonawscom/graphql to fetch Topics , it says "errorType": "UnauthorizedException" . I'm having trouble figuring out how a logged out user can have authorization to publicly accessible data.

Answer 1

In Cognito identity pool you need to set the policy for unauthorized users. Go to Edit Identity Pool and you can see an option where role can be set for unauthorized

Answer 2

AWS AppSync recently launched support for multiple authorization types on the same AppSync API. So you could for example enable cognito user pools as the authorization type on your API and add API_KEY as an additional authorization provider.

After this, you would be able to use the @aws_api_key directive to make selected fields from your schema such as for example getForumTopics be api key authenticated. API Keys are in general considered to give public access.

Also Cognito User Pools and Cognito Federated Identities are separate products. Cognito Federated Identities does indeed have an unauthenticated identity role that you can use to secure top level fields in your schema but it looks like the auth type on your API is set to Cognito User Pools.