aws-amplify / aws-amplify/docs

Add details for AppSync IAM auth regarding `$context.indentity.cognitoIdentityId`

Open
#2,898 1 comment 0 reactions 1 assignee Claimed by @AnilMaktala View on GitHub
amplify/data API GraphQL auth feature-request p4 theme:data-auth
Dominant language
MDX
Stars
506
Forks
1.1k
Avg merge
3h 14m
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
The [GraphQL Auth docs](https://github.com/aws-amplify/docs/blame/master/docs/lib/graphqlapi/fragments/js/authz.md#L56-L107) does not specify any details around `AUTH_TYPE.AWS_IAM` being required to get `$context.indentity.congnitoIdentityId` during AppSync resolvers.

When using a Cognito User Pool with Federated Identity, and following the [cognito s3 access](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html) docs, there is no mention that to have this value in your resolvers you must use `IAM` auth and would assume the use of `AMAZON_COGNITO_USER_POOLS`.

The reference I have found for this detail is from a forum post - https://forums.aws.amazon.com/thread.jspa?threadID=292671

**Describe the solution you'd like**
Add doc/guide describing how to get `$context.identity.cognitoIdentityId` in AppSync resolvers.

Reference that material in:
- https://docs.amplify.aws/sdk/auth/federated-identities/q/platform/ios
- https://docs.amplify.aws/lib/graphqlapi/authz/q/platform/js

**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.

**Additional context**
When using the IAM policy for cognito user access to s3 buckets based on cognito identity ([example](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html)) the resolvers for your AppSync API need to be able to retrieve this information from the request in order to perform actions on behalf of users.
- DynamoDB data based on `cognitoIdenityId`
- ElasticSearch data based on `cognitoIdenityId`
- S3 bucket based on `cognitoIdenityId`
- ...

Searching google produces confusion in this area
- [amplify appsync identity.cognitoIdentityId null](https://www.google.com/search?q=amplify+appsync+identity.cognitoIdentityId+null&oq=amplify+appsync+identity.cognitoIdentityId+null)
- [appsync identity.cognitoIdentityId lambda resolver](https://www.google.com/search?q=appsync+identity.cognitoIdentityId+lambda+resolver&oq=appsync+identity.cognitoIdentityId+lambda+resolver)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.