Clarify usage of privacy.authRoleName and privacy.unAuthRoleName in api-params.json (REST api)

Which Category is your question related to? api

Amplify CLI Version 4.25.0

What AWS Services are you utilizing? API Gateway

Provide additional details e.g. code snippets What is the purpose of privacy.authRoleName and privacy.unAuthRoleName in the api-params.json? How do these values affect the api gateway when using multiple environments?

I can not find any usage of these properties in apigw-cloudformation-template-default.json.ejs. Are they used at all?

[prompt]$ amplify add api
? Please select from one of the below mentioned services: REST
? Provide a friendly name for your resource to be used as a label for this category in the project: testapi
? Provide a path (e.g., /book/{isbn}): /items
? Choose a Lambda source Create a new Lambda function
? Provide a friendly name for your resource to be used as a label for this category in the project: testlambda
? Provide the AWS Lambda function name: testlambda
? Choose the runtime that you want to use: NodeJS
? Choose the function template that you want to use: Hello World
? Do you want to access other resources in this project from your Lambda function? No
? Do you want to invoke this function on a recurring schedule? No
? Do you want to configure Lambda layers for this function? No
? Do you want to edit the local lambda function now? No
Successfully added resource testlambda locally.

[prompt]$ cat amplify/backend/api/testapi/api-params.json 
{
    "paths": [
        {
            "name": "/items",
            "lambdaFunction": "testlambda",
            "privacy": {
                "open": true
            }
        }
    ],
    "resourceName": "testapi",
    "apiName": "testapi",
    "functionArns": [
        {
            "lambdaFunction": "testlambda"
        }
    ],
    "privacy": {
        "auth": 0,
        "unauth": 0,
        "authRoleName": "amplify-demo-live-165557-authRole",
        "unAuthRoleName": "amplify-demo-live-165557-unauthRole"
    },
    "dependsOn": [
        {
            "category": "function",
            "resourceName": "testlambda",
            "attributes": [
                "Name",
                "Arn"
            ]
        }
    ]
}

[ksokol]

That does not answer my questions.

What is the purpose of privacy.authRoleName and privacy.unAuthRoleName in the api-params.json because neither I do see any use of it in the apigw-cloudformation-template-default.json.ejs nor in the final cloudformation template in the api rest category folder in my project. Are they used at all?

How do these two values values affect the api gateway when using multiple environments? Let say I want to merge testing branch into production branch and the values got overwritten with the values from testing. How does it affect the production environment? Do I have a cross connection between the roles from the test environment and the production rest api?

Apparently, the api-params.json file doesn’t matter at all because Amplify doesn’t complain during a push when the api-params.json file is missing (deleted it right before a push, just to see want happens).

Searching for the authRoleName and unAuthRoleName value in my project, it shows up in team-provider-info.json and backend/amplify-meta.json. That makes sence. But I don’t understand why the authRoleName and unAuthRoleName values are hardcoded in the api-params.json of every rest api caterogy.

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels for those types of questions.