@aws-cdk/aws-appsync: Cannot attach @cognito Directives with no groups specified

When attaching a Directive to the GraphQL Schema using the code-first approach the Directive.cognito() requires one to attach at least one group:

Cognito authorization requires at least one Cognito group to be supplied. Received: 0

But this should not be the case. @aws_cognito_user_pools directive does not require a group. If no group is specified it means allow all users authorized through cognito.

Reproduction Steps

    import {
        Directive,
        ResolvableField
    } from "@aws-cdk/aws-appsync";

    api.graphqlAPI.addMutation('setStatus', new ResolvableField({
        args: StatusInput.definition,
        returnType: StatusType.attribute(),
        dataSource: setStatusDataSource,
        directives: [
            Directive.iam(),
            Directive.cognito()
        ]
    }));

What did you expect to happen?

That the schema attaches the @aws_cognito_user_pools directive directive.

What actually happened?

The cdk deploy returned the error:

Cognito authorization requires at least one Cognito group to be supplied. Received: 0

Environment

• CDK CLI Version : 1.89.0
• Framework Version: : 1.89.0
• Node.js Version: v12.16.1
• OS : Windows 10
• Language (Version):

Other

---

This is 🐛 Bug Report

[pfried]

For everyone struggling with this, adding a custom directive like

directives: [Directive.iam(), Directive.custom('@aws_cognito_user_pools')],

will attach the correct directive statement anyways.

@MrArnoldPalmer I tried to fix this in the code. But it is somehow a mess caused by this whole @aws_auth against @aws_cognito_user_pools when multiple are present mess. A quick fix would be to remove the error beeing thrown when 0 groups are passed, but this error is valid and needs to be checked in case it is the only directive when using @aws_auth. Also the whole string replacement is ugly. The statement can only be created in the toString() method as only there is enough information to build the correct statement.

IMHO The statements should be created by a more sophisticated function like createStatement(modes) and Authorization Directives and Subscription Directives should be put in their own Subclass which does not need to be public.

Any thoughts on that?

[MrArnoldPalmer]

@pfried I think I’m with you on this. We need a much smarter and sophisticated system for managing directive statements instead of this basic string interpolation. Separating authorization and subscription directives also makes sense with some common BaseDirective ancestor or something.