[aws-cdk/appsync] - aws_auth directive ignored

type Query {
  getCustomers: [Customer] 
  @aws_auth(cognito_groups: ["Admins"])
  getCustomer(id: String): Customer
}

It would be expected that the above code would restrict the getCustomers query to users who exist in the Admins group. This is an example of the starter code made available on the AppSync CDK page.

Reproduction Steps

Copy the demo code from AppSync CDK, add the above directive to the included graphql.schema, deploy your changes, make a query from a user that is not the specified group, expect to have information returned.

Error Log

Environment

• CLI Version : 1.47.1
• Framework Version:
• Node.js Version: 12.18.2
• OS : Mac OSX
• Language (Version): TypeScript (3.7.2)

Other

---

This is 🐛 Bug Report

[BryanPan342]

@aws_auth is supported by cdk. However, something to note and follow from the appsync documentation is that @aws_auth only works for cognito if it’s the ONLY form of authorization.

If you use additional authorization then you must use the @aws_cognito_user_pool directive. Additionally, there is was an issue before that created an apiKey if additionalAuthorization was not configured (#9054) that was fixed thanks to @warrify

I think what might have happened @tombuckley91 was that the bug from the apiKey was adding an additional configuration that made the @aws_auth directive unusable. Now that it’s fixed though, as long as you only have a single configuration for authorization, @aws_auth should work (from my tests I have gotten it to work).

Rule of thumb:

• If only one authorization configuration, use @aws_auth
• If using multiple configurations, use @aws_cognito_user_pool

@aws_auth and @aws_cognito_user_pool are specific to ONE and MULTIPLE configurations respectively. You cant use @aws_auth for multiple configurations and you cant use @aws_cognito_user_pool for one configuration.

[BryanPan342]

I’m closing this issue for now but if there is something I missed, please reopen it or continue adding to the discussion.