aws-amplify / aws-amplify/amplify-cli

Support Multi-Group Access to AdminAPI

Open
#6,716 6 comments 6 reactions 0 assignees View on GitHub
auth feature-request p3
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

**Is your feature request related to a problem? Please describe.**
Currently, when adding AdminAPI functionality to a project, the CLI only affords me the ability to grant access to a single user group. As a result, in a scenario in which I have two “admin” user groups—say “ops-admin” and “domain-admin”—I cannot authorize both.

**Describe the solution you'd like**
As a user following the principle of least privilege, I should be able to authorize multiple user groups to access the AdminAPI so that I can support multiple groups with administrative functionality.

**Describe alternatives you've considered**
Alternatively, I could create another group--say "api-admin"--and assign users in my existing admin groups to this new group for AdminAPI-access purposes; however, this increases the ops/sec burden.

**Additional context**
I can manually implement this functionality by editing the AdminAPI source in `./amplify/backend/function/AdminQueries`. The `checkGroup` functionality that the AdminAPI utilizes lives in `app.js` file contained in the `src` directory. On line 45 of that file, the allowed group specified via the CLI is pulled in from the environment. Thereafter, starting on line 47, the service runs through a series of checks to determine whether it should authorize the request. The implementation that would need to be changed begins on line 57 (copied below).

```

// Only perform tasks if the user is in a specific group
const allowedGroup = process.env.GROUP;

const checkGroup = function(req, res, next) {
if (req.path == '/signUserOut') {
return next();
}

if (typeof allowedGroup === 'undefined' || allowedGroup === 'NONE') {
return next();
}

// Fail if group enforcement is being used
if (req.apiGateway.event.requestContext.authorizer.claims['cognito:groups']) {
const groups = req.apiGateway.event.requestContext.authorizer.claims['cognito:groups'].split(',');
if (!(allowedGroup && groups.indexOf(allowedGroup) > -1)) {
const err = new Error(`User does not have permissions to perform administrative tasks`);
next(err);
}
} else {
const err = new Error(`User does not have permissions to perform administrative tasks`);
err.statusCode = 403;
next(err);
}
next();
};
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.