aws-amplify / aws-amplify/docs
Add details for AppSync IAM auth regarding `$context.indentity.cognitoIdentityId`
- Dominant language
- MDX
- Stars
- 506
- Forks
- 1.1k
- Avg merge
- 3h 14m
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
The [GraphQL Auth docs](https://github.com/aws-amplify/docs/blame/master/docs/lib/graphqlapi/fragments/js/authz.md#L56-L107) does not specify any details around `AUTH_TYPE.AWS_IAM` being required to get `$context.indentity.congnitoIdentityId` during AppSync resolvers.
When using a Cognito User Pool with Federated Identity, and following the [cognito s3 access](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html) docs, there is no mention that to have this value in your resolvers you must use `IAM` auth and would assume the use of `AMAZON_COGNITO_USER_POOLS`.
The reference I have found for this detail is from a forum post - https://forums.aws.amazon.com/thread.jspa?threadID=292671
**Describe the solution you'd like**
Add doc/guide describing how to get `$context.identity.cognitoIdentityId` in AppSync resolvers.
Reference that material in:
- https://docs.amplify.aws/sdk/auth/federated-identities/q/platform/ios
- https://docs.amplify.aws/lib/graphqlapi/authz/q/platform/js
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
When using the IAM policy for cognito user access to s3 buckets based on cognito identity ([example](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html)) the resolvers for your AppSync API need to be able to retrieve this information from the request in order to perform actions on behalf of users.
- DynamoDB data based on `cognitoIdenityId`
- ElasticSearch data based on `cognitoIdenityId`
- S3 bucket based on `cognitoIdenityId`
- ...
Searching google produces confusion in this area
- [amplify appsync identity.cognitoIdentityId null](https://www.google.com/search?q=amplify+appsync+identity.cognitoIdentityId+null&oq=amplify+appsync+identity.cognitoIdentityId+null)
- [appsync identity.cognitoIdentityId lambda resolver](https://www.google.com/search?q=appsync+identity.cognitoIdentityId+lambda+resolver&oq=appsync+identity.cognitoIdentityId+lambda+resolver)
Contributor guide
Assessment
This issue has not been assessed yet.