Setting up correct policies for allowing my Amplify Function to be invoked from graphql

Question

Hello!   
What I'm trying to do is create a admin user group that has the rights to trigger a function through a button in my admin UI.

I followed this simple getting-started-guide to get functions working in Amplify using a data query.   
https://docs.amplify.aws/react/build-a-backend/functions/set-up-function/  
As I understand it uses graphql in the background.

But when I'm trying to run the code it does not work.

First I got:
```
POST https://54mldovcb5fyvkqjkirkiolcee.appsync-api.eu-north-1.amazonaws.com/graphql  
401 Unauthorized
```

So I'll added my Cognito User (admin) to a group (ADMINS) and gave that group a IAM Role (ADMIN-ROLE). I gave that IAM Role the 'AdministratorAccess-Amplify', because it had a lot of permissions I thought would cover this issue.

Then I got:
```
Custom operation sayHello requires both an authorization rule and a handler reference
Caused By: Custom operation sayHello requires both an authorization rule and a handler reference

Resolution: Check your data schema definition for syntax and type errors.
```
So I added auth to my query
```
  sayHello: a
    .query()
    .arguments({
      name: a.string(),
    })
    .returns(a.string())
    .handler(a.handler.function(sayHello))
**    .authorization(allow => [allow.authenticated()]),**
```

Then I got:
```
InvalidIdentityPoolConfigurationException: Invalid identity pool configuration. Check assigned IAM roles for this pool.
```

I read something about trust relationships and found this info after reading up more on Cognito
https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html

Adding this to my setup does not solve the issue, but maybe a bit closer?

I now get this in the console when logging the response
```
Object { data: null, errors: (1) […] }
data: null
errors: Array [ {…} ]
0: Object { path: (1) […], errorType: "Unauthorized", message: "Not Authorized to access sayHello on type Query", … }
data: null
errorInfo: null
errorType: "Unauthorized"
locations: Array [ {…} ]
message: "Not Authorized to access sayHello on type Query"
path: Array [ "sayHello" ]
0: "sayHello"
```
I think this means that I have given my identity pool some kind of access to IAM Role.

But what is next? Do I need to add some more permissions?

re:Post Agent · Accepted Answer

It seems you're facing a series of authorization issues while trying to set up an Amplify Function to be invoked from GraphQL. Let's break down the problem and address each step:

1. The initial 401 Unauthorized error suggests that your authentication wasn't set up correctly. You've taken the right step by adding your Cognito User to an ADMINS group and associating it with an IAM role.

2. The "Custom operation sayHello requires both an authorization rule and a handler reference" error was correctly addressed by adding the authorization rule to your query.

3. The "InvalidIdentityPoolConfigurationException" indicates that there might be an issue with the IAM roles associated with your Cognito Identity Pool. Make sure that the Identity Pool has both authenticated and unauthenticated roles properly configured.

4. The final "Not Authorized to access sayHello on type Query" error suggests that while your authentication is now working, the permissions are not correctly set up to allow access to the specific GraphQL operation.

To resolve this, you need to ensure that:

1. The IAM role associated with your Cognito User Group (ADMIN-ROLE) has the necessary permissions to invoke the Lambda function associated with your GraphQL operation.

2. The Lambda function itself has a resource-based policy that allows invocation from AppSync. You can add this permission using the AWS CLI or the Lambda console.

3. In your AppSync API, make sure that the data source (Lambda function) is correctly linked to the resolver for the 'sayHello' query.

4. Check that the authorization mode for your AppSync API is set to "Amazon Cognito User Pools" and that it's correctly linked to your User Pool.

5. In your schema, ensure that the 'sayHello' query has the correct authorization directive, for example:

```graphql
   type Query {
     sayHello(name: String!): String
       @auth(rules: [{ allow: groups, groups: ["ADMINS"] }])
   }
   ```

6. If you're using fine-grained access control, make sure your resolvers are set up to check for the correct group membership.

Remember, the principle of least privilege is important. Instead of using 'AdministratorAccess-Amplify', create a more specific IAM policy that only grants the necessary permissions for invoking the Lambda function and accessing AppSync.

By carefully reviewing and adjusting these settings, you should be able to resolve the authorization issues and successfully invoke your Amplify Function from GraphQL.  
**Sources**  
[Configuring authorization and authentication to secure your GraphQL APIs - AWS AppSync](https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html)  
[Granting function access to an organization - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-organization.html)  
[Grant access to other resources - AWS Amplify Gen 2 Documentation](https://docs.amplify.aws/react/build-a-backend/functions/grant-access-to-other-resources/)

Setting up correct policies for allowing my Amplify Function to be invoked from graphql

Add your answer

Relevant content