Pipeline resolver field-level authorization

Which Category is your question related to? AppSync

Amplify CLI Version 4.13.1

What AWS Services are you utilizing? AppSync, DynamoDB

Provide additional details e.g. code snippets Is it possible to use pipeline resolvers for field-level authorization? All of the tutorials and documentation I’ve run across so far show how to do an authorization check and then return either an unauthorized error or the entire query result, like this:

#if(## authorization check logic goes here)
    $util.unauthorized()
#end 

$util.toJson($ctx.result)

I’m wondering if it’s possible to return only some of the dynamo record fields from the result, depending on the outcome of the authorization check.

[SwaySway]

Hello @sopranolinist Another potential solution would be to use a lambda function to handle this authorization logic you are looking for. When chaining this directive on the same field will create a pipeline resolver for the field. Function Docs here: https://docs.amplify.aws/cli/graphql-transformer/directives#function

type User @model {
  id: ID!
  name: String
  email: AWSEmail
  ssn: String @function(name: "myAuthFunction")
}

[SwaySway]

One potential way to address this would be to use the @auth, a directive provided as a part of the GraphQL Transformer. Docs here on @auth: https://docs.amplify.aws/cli/graphql-transformer/directives#field-level-authorization

An example of the usecase you provided could be something like the following

type User @model @auth(rules: [
  { allow: groups, groups: ["Mananger, Employee"] }
]) {
  id: ID!
  name: String
  email: AWSEmail
  # only a manager has access of this field
  ssn: String @auth(rules: [{ allow: groups, groups: ["Manager"] }])
}