Access Congito authorized AppSync API from a Lambda function - amazon-web-services

Question

I want to invoke mutations on my AppSync API from Lambda functions in response to external events. Now I have been able to do this if I set AppSync to use IAM authorization and then provide access in the role of my Lambda function. The problem is that I need to use Cognito authorization because I need access to Cognito usernames in many of my resolver templates and I do not know of any way to do this when using IAM authorization.
I would thus like to know if there is any way I can authorise a Lambda function using Cognito User Pools to call my AppSync endpoint. Obviously I can create a dummy user in my pool and simply log in with it in the Lambda but Cognito User Pool logins are a very slow process and this method just sounds wrong anyway. The mutations I want to call from Lambdas don't need any Cognito info anyway.
What would also solve my problem is if I had a way to access the Cognito username in resolver templates when using IAM authorization.

Answer 1

With user pools as your authentication mechanism, there is no way to get tokens to authorize with AWS AppSync without signing in, at some point. With that said, you could mitigate the overhead of that a bit. Ultimately, it boils down to what you suggested in your question, using a 'fake user'. It's not an uncommon solution, and involves having some admin level user, the credentials for whom would only be accessed from this Lambda.
First of all, I would recommend you not use the traditional SRP login, for latency reasons. One alternative would be to use AdminInitiateAuth/ADMIN_NO_SRP_AUTH, to offload the overhead of SRP calculations from your Lambda to the Cognito back end, with ADMIN_NO_SRP_AUTH turned on in your pool. I saw from your other question (Authenticate AppSync request with adminInitiateAuth) that you were thinking of doing this, however it is important to point out this is simply a different API used to sign a user in. You can read more about it here: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.html#amazon-cognito-user-pools-server-side-authentication-flow
An additional alternative could be a custom authentication flow. The same link above has more details on how to do this, but in short, you could set up a quicker flow that fits whatever specific needs your add has.
To improve overhead a bit more, you could then keep those tokens cached, to some degree. That could just mean keeping it in memory in the Lambda and checking their validity/expiry before using them, or even attaching a remote caching mechanism.

Answer 2

#Gerharddc, what if do you try to add policies that allow unauthenticated access to your Cognito Identity Pool?
I have this piece of code that defines authenticated and unauthenticated access to my Identity Pool (you can check the full code here in my personal project).
IdentityPoolUnauthorizedIAMRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Federated: cognito-identity.amazonaws.com
Action:
- sts:AssumeRoleWithWebIdentity
Condition:
StringEquals:
cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
ForAnyValue:StringLike:
cognito-identity.amazonaws.com:amr: unauthenticated
Policies:
- PolicyName: CognitoUserSignInUnauthorizedPolicy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- mobileanalytics:PutEvents
- mobiletargeting:PutEvents
- cognito-sync:*
- cognito-identity:*
Resource: '*'
IdentityPoolAuthorizedIAMRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Federated: cognito-identity.amazonaws.com
Action:
- sts:AssumeRoleWithWebIdentity
Condition:
StringEquals:
cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
ForAnyValue:StringLike:
cognito-identity.amazonaws.com:amr: authenticated
Policies:
- PolicyName: CognitoUserSignInAuthorizedPolicy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- mobileanalytics:PutEvents
- mobiletargeting:PutEvents
- cognito-sync:*
- cognito-identity:*
Resource: '*'
# Assigns the roles to the Identity Pool
CognitoIdentityPoolRoleAttachment:
Type: AWS::Cognito::IdentityPoolRoleAttachment
Properties:
IdentityPoolId: !Ref CognitoIdentityPool
Roles:
unauthenticated: !GetAtt IdentityPoolUnauthorizedIAMRole.Arn
authenticated: !GetAtt IdentityPoolAuthorizedIAMRole.Arn
When I declare my AWS AppSync template, I add this template that permits users to access my AppSync endpoint when signed in:
AppSyncIAMPolicy:
Type: AWS::IAM::Policy
Description: Allow user consume AppSync when signed in
DependsOn: AppSyncGraphQLApi
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- appsync:GraphQL
Resource:
- !Join ['/', [!GetAtt AppSyncGraphQLApi.Arn, '*']]
PolicyName: !Sub ${StackName}-appsync-iam-policy
Roles:
- !Sub ${IdentityPoolAuthorizedIAMRoleRef}
My point is: you can attach a policy that allows users not signed (unauthenticated) access AppSync. Instead - !Sub ${IdentityPoolAuthorizedIAMRoleRef} you can in the template above, you can try - !Sub ${IdentityPoolUnauthorizedIAMRoleRef}.
Of course, you can specify which endpoints you allow unauthenticated access, for example:
AppSyncIAMPolicy:
Type: AWS::IAM::Policy
Description: Allow user consume AppSync when NOT signed in
DependsOn: AppSyncGraphQLApi
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- appsync:GraphQL
Resource:
- arn:aws:appsync:us-west-2:123456789012:apis/YourGraphQLApiId/types/Query/fields/<Field-1>
- arn:aws:appsync:us-west-2:123456789012:apis/YourGraphQLApiId/types/Query/fields/<Field-2>
PolicyName: !Sub ${StackName}-appsync-iam-policy-unauthenticated
Roles:
- !Sub ${IdentityPoolUnauthorizedIAMRoleRef}