aws-amplify / aws-amplify/amplify-cli
Support Multi-Group Access to AdminAPI
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
**Is your feature request related to a problem? Please describe.**
Currently, when adding AdminAPI functionality to a project, the CLI only affords me the ability to grant access to a single user group. As a result, in a scenario in which I have two “admin” user groups—say “ops-admin” and “domain-admin”—I cannot authorize both.
**Describe the solution you'd like**
As a user following the principle of least privilege, I should be able to authorize multiple user groups to access the AdminAPI so that I can support multiple groups with administrative functionality.
**Describe alternatives you've considered**
Alternatively, I could create another group--say "api-admin"--and assign users in my existing admin groups to this new group for AdminAPI-access purposes; however, this increases the ops/sec burden.
**Additional context**
I can manually implement this functionality by editing the AdminAPI source in `./amplify/backend/function/AdminQueries`. The `checkGroup` functionality that the AdminAPI utilizes lives in `app.js` file contained in the `src` directory. On line 45 of that file, the allowed group specified via the CLI is pulled in from the environment. Thereafter, starting on line 47, the service runs through a series of checks to determine whether it should authorize the request. The implementation that would need to be changed begins on line 57 (copied below).
```
// Only perform tasks if the user is in a specific group
const allowedGroup = process.env.GROUP;
const checkGroup = function(req, res, next) {
if (req.path == '/signUserOut') {
return next();
}
if (typeof allowedGroup === 'undefined' || allowedGroup === 'NONE') {
return next();
}
// Fail if group enforcement is being used
if (req.apiGateway.event.requestContext.authorizer.claims['cognito:groups']) {
const groups = req.apiGateway.event.requestContext.authorizer.claims['cognito:groups'].split(',');
if (!(allowedGroup && groups.indexOf(allowedGroup) > -1)) {
const err = new Error(`User does not have permissions to perform administrative tasks`);
next(err);
}
} else {
const err = new Error(`User does not have permissions to perform administrative tasks`);
err.statusCode = 403;
next(err);
}
next();
};
```
Contributor guide
Assessment
This issue has not been assessed yet.