Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Amplify Gen 2 mobile app: how to safely use amplify_outputs.json when frontend is not on AWS?

0

Hi everyone, I’m building a mobile app with Expo (React Native) and using AWS Amplify Gen 2 for the backend (Cognito, AppSync, etc.). It creates an amplify_outputs.json file that contains things like: User Pool ID User Pool Client ID Identity Pool ID AppSync GraphQL API URL From what I understand, my mobile app needs this config at runtime so I can call: import { Amplify } from "aws-amplify"; import outputs from "./amplify_outputs.json";

Amplify.configure(outputs);

My questions are: Is it safe to expose the values in amplify_outputs.json in a mobile app? I know AWS docs say these IDs/URLs are usually not treated as secrets, but I want to confirm best practices specifically for Amplify Gen 2 + mobile. How should I handle amplify_outputs.json with Git and CI/CD when my frontend is not built on AWS? A lot of examples recommend adding amplify_outputs.json to .gitignore and regenerating it in the build pipeline. In my case, the frontend build is done by another company (not on AWS). What’s the recommended workflow to provide them the config they need without checking secrets into Git, and still following Amplify best practices? Is there anything in amplify_outputs.json that should be treated as a secret and never shipped with the app? (For example, I know Cognito client secrets and API keys for third-party services should stay on the backend only.) I’d really appreciate any guidance or examples of how people are handling amplify_outputs.json in production for mobile apps, especially when the frontend build is outsourced / not on AWS. Thanks!

Topics
Application IntegrationServerlessFront-End Web & MobileSecurity, Identity, & Compliance
Tags
AWS AppSyncAmazon CognitoAWS AmplifySecurity, Identity, & Compliance
Language
English

asked 9 months ago230 views

1 Answer
0

For AWS Amplify Gen 2 mobile apps, the amplify_outputs.json file contains configuration information that your app needs at runtime to connect to AWS services.

Regarding your questions:

  1. Safety of exposing values in amplify_outputs.json: The information in this file (User Pool ID, User Pool Client ID, Identity Pool ID, AppSync GraphQL API URL) is generally not considered sensitive. These are public identifiers that clients need to connect to your AWS resources. However, they should be protected by proper authentication and authorization controls on the AWS services themselves.

  2. Handling amplify_outputs.json with Git and CI/CD: The recommended practice is to add amplify_outputs.json to your .gitignore file. This file is git-ignored by default in Amplify projects. For your specific situation where the frontend is built by another company:

  • You can generate the outputs file during your backend deployment using npx ampx pipeline-deploy or npx ampx generate outputs
  • Then securely share this generated file with your frontend partner through a secure channel (not in Git)
  • They can include this file during their build process
  1. Sensitive information: The amplify_outputs.json file typically doesn't contain highly sensitive information like access keys or secrets. AWS Amplify is designed to work with public identifiers that require proper authentication to access resources. However, you should review the file contents to ensure no API keys or other secrets were added during customization.

AWS Amplify supports various development workflows, including scenarios where frontend and backend teams work in separate repositories, so your setup with an external frontend team is a supported use case. The key is to establish a secure process for sharing the generated outputs file with your frontend partner as part of your deployment pipeline.
Sources
Is amplify_outputs.json safe in client code + should we gitignore it | AWS re:Post
AWS Frontend web and mobile category icon Frontend web and mobile services - Overview of Amazon Web Services
AWS Amplify | Extensible Web & Mobile Apps | Amazon Web Services

answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content