AppSync authorization

Question

I currently have APIs which I am currently implementing using AWS Appsync and Cognito as authorizer. I have a couple of APIs that should be used without authentication (before the user registration) and I thought about using API KEYS with appsync for that purpose ()
But I noticed that: "API keys are configurable for up to 365 days, and you can extend an existing expiration date for up to another 365 days from that day"
So the key should last 2 years maximum (https://docs.aws.amazon.com/en_us/appsync/latest/devguide/security.html#api-key-authorization) . Can you please suggest us the best way to manage the api key change? My app clients are ios/android apps using amplify framework, and I would like to avoid to create a release dedicated to the api key change every 1/2 year.

My questions:

- is API keys the best way to address this use case?
- how to effectively manage the API keys renewal process?

Accepted Answer

If you don't want to manage API Key rotation, use Cognito Unauth Roles and IAM auth on AppSync. Easily configured using the Amplify CLI and the GraphQL Transform: https://aws-amplify.github.io/docs/cli-toolchain/graphql#public-authorization

# public authorization with provider override
    type Post @model @auth(rules: [{allow: public, provider: iam}]) {
      id: ID!
      title: String!
    }

AppSync authorization

Contenus pertinents