AWS AppSync Penetration Test

Hi all,

We have a running AppSync application that uses DynamoDB, Lambda and S3. Our client is requesting for the AppSync URL to run 3rd party penetration tests.

Based on the security docs (https://aws.amazon.com/security/penetration-testing/), we are not allowed to run pen tests on AppSync, DynamoDB and S3. My question is, how can we go about running the pen tests on our AppSync Application?

Thanks!