aws-amplify / aws-amplify/amplify-data

AppSync subscriptions using Private API / VPC endpoints

Open
#469 6 comments 0 reactions 0 assignees View on GitHub
feature-request GraphQL pending-community-response
Dominant language
TypeScript
Stars
18
Forks
23
Avg merge
26m
Merged PRs (30d)
1

Description

### Is this related to a new or existing framework?

_No response_

### Is this related to a new or existing API?

GraphQL API

### Is this related to another service?

AppSync

### Describe the feature you'd like to request

I would like to be able to use GraphQL subscriptions when Private API is enabled on AWS AppSync. I'm not sure if the current amplify-js behavior is an intended omission or a buggy behavior.

### Current behavior

Using VPC endpoints with AppSync requires using a hostname of the form: {vpc_endpoint_id}-{endpoint_dns_identifier}.appsync-api.{region}.vpce.amazonaws.com when connecting on the network level.

For AppSync to be able to identify the API backend when sending the request to the VPC endpoint one has to pass a host header like this: {"host": "{api_url_identifier}.appsync-api.{region}.amazonaws.com"}

amplify-js has the possibility of passing "graphql_headers" as an option to GraphQLAPI.graphql(). Passing these "graphql_headers" works with queries and mutations, but not with subscriptions. Subscriptions result in a 404 error:
"Error: Unexpected server response: 404 at ClientRequest"

### Expected behavior

On the command line I can connect to a private AppSync subscription like this using the VPC endpoint:
```
header=`echo '{"host":"{api_url_identifier}.appsync-api.{region}.amazonaws.com","x-api-key":"da2-{xxxxxxxxxxxxxxxxxxxxxxxxxx}"}' | base64 -w0`
wscat -H "X-AppSync-Domain:{api_url_identifier}.appsync-realtime-api.{region}.amazonaws.com" -p 13 -s graphql-ws -c "wss://{vpc_endpoint_id}-{endpoint_dns_identifier}.appsync-api.{region}.vpce.amazonaws.com/graphql?header=$header&payload=e30="
```

The host is encoded in the header parameter which AppSync uses to identify the correct API backend.

Looking into the source code when using the AWSAppSyncRealTimeProvider the "host" variable which is later encoded is set exclusively by appSyncGraphqlEndpoint, which is set through the API config aws_appsync_graphqlEndpoint and which is the VPC endpoint in this case:

https://github.com/aws-amplify/amplify-js/blob/c3a06153e3ffe05dd65485a22b1f99aabe9b3d83/packages/pubsub/src/Providers/AWSAppSyncRealTimeProvider/index.ts#L918

There is no alternative to using the VPC endpoint as the host parameter.

Using queries and mutations the graphql_headers seem to be attached correctly so that AppSync can process the request:

https://github.com/aws-amplify/amplify-js/blob/c3a06153e3ffe05dd65485a22b1f99aabe9b3d83/packages/api-graphql/src/internals/InternalGraphQLAPI.ts#L286

### Describe the solution you'd like

I would like to have graphql_headers passed to AppSync subscriptions encoded into the header parameter for the websocket connection in order to use GraphQL subscriptions on AppSync Private APIs.

### Describe alternatives you've considered

Nothing to mention here.

### Additional context

Using
amplify-js 5.3.11
nodejs v20.3.1
ws 8.14.2

### Is this something that you'd be interested in working on?

- [ ] 👋 I may be able to implement this feature request
- [ ] ⚠️ This feature might incur a breaking change

Contributor guide

Open the contributing guide

Research direction

Read packages/pubsub/src/Providers/AWSAppSyncRealTimeProvider/index.ts around line 918 and packages/api-graphql/src/internals/InternalGraphQLAPI.ts around line 286. Trace how graphql_headers reach queries and mutations versus the subscription websocket header parameter. Done means private AppSync subscriptions use the configured host header and no longer return a 404 through a VPC endpoint.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, graphql, typescript
Domain
api, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.