Skip to content

Commit 7a225f8

Browse files
author
Michael Brewer
authored
docs: add sample usage for lamda authorizer
1 parent 1e59652 commit 7a225f8

File tree

1 file changed

+49
-0
lines changed

1 file changed

+49
-0
lines changed

docs/utilities/data_classes.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ Event Source | Data_class
6363
[API Gateway Proxy V2](#api-gateway-proxy-v2) | `APIGatewayProxyEventV2`
6464
[Application Load Balancer](#application-load-balancer) | `ALBEvent`
6565
[AppSync Resolver](#appsync-resolver) | `AppSyncResolverEvent`
66+
[AppSync Authorizer](#appsync-authorizer) | `AppSyncAuthorizerEvent`
6667
[CloudWatch Logs](#cloudwatch-logs) | `CloudWatchLogsEvent`
6768
[CodePipeline Job Event](#codepipeline-job) | `CodePipelineJobEvent`
6869
[Cognito User Pool](#cognito-user-pool) | Multiple available under `cognito_user_pool_event`
@@ -128,6 +129,54 @@ Is it used for Application load balancer event.
128129
do_something_with(event.json_body, event.query_string_parameters)
129130
```
130131

132+
## AppSync Authorizer
133+
134+
> New in 1.20.0
135+
136+
Used when building an [AWS_LAMBDA Authorization](https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#aws-lambda-authorization){target="_blank"} with AppSync.
137+
See blog post [Introducing Lambda authorization for AWS AppSync GraphQL APIs](https://aws.amazon.com/blogs/mobile/appsync-lambda-auth/){target="_blank"}
138+
or read the Amplify documentation on using [AWS Lambda for authorization](https://docs.amplify.aws/lib/graphqlapi/authz/q/platform/js#aws-lambda){target="_blank"} with AppSync.
139+
140+
In this example extract the `requestId` as the `correlation_id` for logging and builds the AppSync authorizer
141+
using the `AppSyncAuthorizerResponse` helper.
142+
143+
=== "app.py"
144+
145+
```python
146+
from typing import Dict
147+
148+
from aws_lambda_powertools.logging import correlation_paths
149+
from aws_lambda_powertools.logging.logger import Logger
150+
from aws_lambda_powertools.utilities.data_classes.appsync_authorizer_event import (
151+
AppSyncAuthorizerEvent,
152+
AppSyncAuthorizerResponse,
153+
)
154+
from aws_lambda_powertools.utilities.data_classes.event_source import event_source
155+
156+
logger = Logger()
157+
158+
159+
def get_user_by_token(token: str):
160+
"""Look a user by token"""
161+
162+
163+
@logger.inject_lambda_context(correlation_id_path=correlation_paths.APPSYNC_AUTHORIZER)
164+
@event_source(data_class=AppSyncAuthorizerEvent)
165+
def lambda_handler(event: AppSyncAuthorizerEvent, context) -> Dict:
166+
user = get_user_by_token(event.authorization_token)
167+
168+
if not user:
169+
# No user found, return not authorized
170+
return AppSyncAuthorizerResponse().to_dict()
171+
172+
return AppSyncAuthorizerResponse(
173+
authorize=True,
174+
resolver_context={"id": user.id},
175+
# Only allow admins to delete events
176+
deny_fields=None if user.is_admin else ["Mutation.deleteEvent"],
177+
).asdict()
178+
```
179+
131180
### AppSync Resolver
132181

133182
> New in 1.12.0

0 commit comments

Comments
 (0)