@aws-amplify/graphql-api-construct 1.6.0 → 1.7.0-iam-auth.0

package/src/types.ts

@@ -28,25 +28,68 @@ export interface IAMAuthorizationConfig {
   /**
    * ID for the Cognito Identity Pool vending auth and unauth roles.
    * Format: `<region>:<id string>`
+   *
+   * @deprecated Use 'IdentityPoolAuthorizationConfig.identityPoolId' instead.
+   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly identityPoolId: string;
+  readonly identityPoolId?: string;
 
   /**
    * Authenticated user role, applies to { provider: iam, allow: private } access.
+   *
+   * @deprecated Use 'IdentityPoolAuthorizationConfig.authenticatedUserRole' instead.
+   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly authenticatedUserRole: IRole;
+  readonly authenticatedUserRole?: IRole;
 
   /**
    * Unauthenticated user role, applies to { provider: iam, allow: public } access.
+   *
+   * @deprecated Use 'IdentityPoolAuthorizationConfig.unauthenticatedUserRole' instead.
+   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly unauthenticatedUserRole: IRole;
+  readonly unauthenticatedUserRole?: IRole;
 
   /**
    * A list of IAM roles which will be granted full read/write access to the generated model if IAM auth is enabled.
    * If an IRole is provided, the role `name` will be used for matching.
    * If a string is provided, the raw value will be used for matching.
+   *
+   * @deprecated Use 'enableIamAuthorizationMode' and IAM Policy to control access for IAM principals.
+   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
   readonly allowListedRoles?: (IRole | string)[];
+
+  /**
+   * Enables access for IAM principals. If enabled @auth directive rules are not applied.
+   * Instead, access should be defined by IAM Policy, see https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html.
+   *
+   * Does not apply to authenticated and unauthenticated IAM Roles attached to Cognito Identity Pool.
+   * Use IdentityPoolAuthorizationConfig to configure their access.
+   */
+  readonly enableIamAuthorizationMode?: boolean;
+}
+
+/**
+ * Configuration for Cognito Identity Pool Authorization on the Graphql Api.
+ * @struct - required since this interface begins with an 'I'
+ */
+export interface IdentityPoolAuthorizationConfig {
+  /**
+   * ID for the Cognito Identity Pool vending auth and unauth roles.
+   * Format: `<region>:<id string>`
+   */
+  readonly identityPoolId: string;
+
+  /**
+   * Authenticated user role, applies to { provider: iam, allow: private } access.
+   */
+  readonly authenticatedUserRole: IRole;
+
+  /**
+   * Unauthenticated user role, applies to { provider: iam, allow: public } access.
+   */
+  readonly unauthenticatedUserRole: IRole;
 }
 
 /**
@@ -134,11 +177,19 @@ export interface AuthorizationModes {
   readonly defaultAuthorizationMode?: 'AWS_IAM' | 'AMAZON_COGNITO_USER_POOLS' | 'OPENID_CONNECT' | 'API_KEY' | 'AWS_LAMBDA';
 
   /**
-   * IAM Auth config, required if an 'iam' auth provider is specified in the Api.
-   * Applies to 'public' and 'private' auth strategies.
+   * IAM Auth config, required to allow IAM-based access to this API.
+   * This applies to any IAM principal except Amazon Cognito identity pool's authenticated and unauthenticated roles.
+   * This behavior was has recently been improved.
+   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
   readonly iamConfig?: IAMAuthorizationConfig;
 
+  /**
+   * Cognito Identity Pool config, required if an 'identityPool' auth provider is specified in the Api.
+   * Applies to 'public' and 'private' auth strategies.
+   */
+  readonly identityPoolConfig?: IdentityPoolAuthorizationConfig;
+
   /**
    * Cognito UserPool config, required if a 'userPools' auth provider is specified in the Api.
    * Applies to 'owner', 'private', and 'group' auth strategies.