feat(appsync): extend authorization configuration #6260

duarten · 2020-02-13T02:42:35Z

By default, the AppSync L2 constructs use API key authorization, but don't allow configuring the API key.

Fix that by allowing a default authorization mode to be specified. Currently, the supported modes are Cognito user pools and API keys. When specifying API key authorization, allow configuring it.

Also add the ability to specify additional authorization modes, currently limited to Cognito user pools and API keys.

BREAKING CHANGE:
Configuring the user pool authorization is now done through the
authorizationConfig property, allowing to configure the default
and additional authorization modes.

Fixes #6246
Fixes #6247

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation · 2020-02-13T14:22:52Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 9bc636d
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2020-02-13T16:29:20Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 3adf65a
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

MrArnoldPalmer

Overall looks great! We have to replace the union type so this works for JSII.

Question about this vs the cloudformation resource params. Any auth mode can either be default or "additional" right? That would mean we can just add more to the AuthModes struct going forward to keep the api consistent.

MrArnoldPalmer · 2020-02-14T17:35:57Z

packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts

+    return (obj as ApiKeyConfig).apiKeyDesc !== undefined;
+}
+
+type AuthModes = UserPoolConfig | ApiKeyConfig;


JSII doesn't support unions currently. Usually the workaround is to make an interface that multiple classes implement.

I didn't get any compiler errors and I see examples of union types elsewhere.

I tried a common interface and I got errors complaining about them not being used in the exported classes, but I can try again.

With

interface UserPoolConfig extends AuthMode { ... } interface ApiKeyConfig extends AuthMode { ... } export interface AuthorizationConfig { readonly defaultAuthorization?: AuthMode; readonly additionalAuthorizationModes?: [AuthMode] }

I get:

error: [awslint:no-unused-type:@aws-cdk/aws-appsync.UserPoolDefaultAction] type or enum is not used by exported classes (declared at lib/graphqlapi.ts:17)

Because now the exported classes deal in terms of AuthMode.

This feels like a bug in awslint because I'm still using those types in a function (e.g., userPoolDescFrom(upConfig: UserPoolConfig)), but I'm unsure how to proceed.

It packaged fine with the union type. In Java, it mapped to

@software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Experimental) public Builder defaultAuthorization(software.amazon.awscdk.services.appsync.UserPoolConfig defaultAuthorization) { this.defaultAuthorization = defaultAuthorization; return this; } @software.amazon.jsii.Stability(software.amazon.jsii.Stability.Level.Experimental) public Builder defaultAuthorization(software.amazon.awscdk.services.appsync.ApiKeyConfig defaultAuthorization) { this.defaultAuthorization = defaultAuthorization; return this; }

duarten · 2020-02-14T17:52:15Z

Yes, any mode can be default and an additional one.

duarten · 2020-02-19T13:58:19Z

Added a commit replacing the union type with a type hierarchy.

Pull request has been modified.

aws-cdk-automation · 2020-02-19T14:49:25Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 988a115
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

MrArnoldPalmer · 2020-02-21T22:45:46Z

packages/@aws-cdk/aws-appsync/test/integ.graphql.ts

@@ -17,6 +35,7 @@ const customerTable = new Table(stack, 'CustomerTable', {
        name: 'id',
        type: AttributeType.STRING,
    },
+    removalPolicy: RemovalPolicy.DESTROY,


Was the retain removal policy causing failures in the integ tests for you?

No, but it was annoying me to have a ton of left over tables in my account.

Agreed. Lets pull it out of this PR so we can double check with other team members on implications before doing this. Most likely fine though for a future chore.

Done. I opened #6401.

By default, the AppSync L2 constructs use API key authorization, but it doesn't allow configuring the API key. Fix that by allowing a default authorization mode to be specified. Currently, the supported modes are Cognito user pools and API keys. When specifying API key authorization, allow configuring it. BREAKING CHANGE: Configuration the user pool authorization is now done through the authorizationConfig property. This allows us to specify a default authorization mode out of the supported ones, currently limited to Cognito user pools and API keys. Fixes aws#6246 Signed-off-by: Duarte Nunes <duarte@uma.ni>

Currently the AppSync L2 constructs don't provide a way to configure additional authorization modes. Add the ability to specify additional authorization modes, currently limited to Cognito user pools and API keys. Fixes aws#6247 Signed-off-by: Duarte Nunes <duarte@uma.ni>

aws-cdk-automation · 2020-02-22T02:37:49Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: f9fb09c
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Test using cognito user pools as the default authorization mode and an api key as the additional mode. Signed-off-by: Duarte Nunes <duarte@uma.ni>

aws-cdk-automation · 2020-02-22T05:33:01Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 78ed6b8
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

MrArnoldPalmer

🔥 🔥 🔥

mergify · 2020-02-25T17:39:15Z

Thank you for contributing! Your pull request is now being automatically merged.

aws-cdk-automation · 2020-02-25T18:37:13Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: e4d08a4
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2020-02-25T18:37:38Z

Thank you for contributing! Your pull request is now being automatically merged.

duarten force-pushed the feature/aws-appsync-additional-auth branch from 257e725 to 9bc636d Compare February 13, 2020 13:58

duarten force-pushed the feature/aws-appsync-additional-auth branch from 9bc636d to 3adf65a Compare February 13, 2020 15:36

SomayaB assigned MrArnoldPalmer Feb 13, 2020

duarten requested a review from MrArnoldPalmer February 14, 2020 14:24

MrArnoldPalmer previously requested changes Feb 14, 2020

View reviewed changes

duarten force-pushed the feature/aws-appsync-additional-auth branch from 3adf65a to 988a115 Compare February 19, 2020 13:58

MrArnoldPalmer reviewed Feb 21, 2020

View reviewed changes

duarten added 2 commits February 21, 2020 23:09

duarten force-pushed the feature/aws-appsync-additional-auth branch from 988a115 to f9fb09c Compare February 22, 2020 02:13

test(integ.graphql): test cognito and api key authorization

78ed6b8

Test using cognito user pools as the default authorization mode and an api key as the additional mode. Signed-off-by: Duarte Nunes <duarte@uma.ni>

duarten force-pushed the feature/aws-appsync-additional-auth branch from f9fb09c to 78ed6b8 Compare February 22, 2020 04:50

MrArnoldPalmer approved these changes Feb 25, 2020

View reviewed changes

Merge branch 'master' into feature/aws-appsync-additional-auth

e4d08a4

mergify bot merged commit 948881a into aws:master Feb 25, 2020

duarten deleted the feature/aws-appsync-additional-auth branch February 29, 2020 17:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(appsync): extend authorization configuration #6260

feat(appsync): extend authorization configuration #6260

duarten commented Feb 13, 2020 •

edited

Loading

aws-cdk-automation commented Feb 13, 2020

aws-cdk-automation commented Feb 13, 2020

MrArnoldPalmer left a comment

MrArnoldPalmer Feb 14, 2020

duarten Feb 14, 2020

duarten Feb 15, 2020

duarten Feb 15, 2020

duarten commented Feb 14, 2020

duarten commented Feb 19, 2020

aws-cdk-automation commented Feb 19, 2020

MrArnoldPalmer Feb 21, 2020

duarten Feb 21, 2020

MrArnoldPalmer Feb 22, 2020

duarten Feb 22, 2020

aws-cdk-automation commented Feb 22, 2020

aws-cdk-automation commented Feb 22, 2020

MrArnoldPalmer left a comment

mergify bot commented Feb 25, 2020

aws-cdk-automation commented Feb 25, 2020

mergify bot commented Feb 25, 2020

feat(appsync): extend authorization configuration #6260

feat(appsync): extend authorization configuration #6260

Conversation

duarten commented Feb 13, 2020 • edited Loading

aws-cdk-automation commented Feb 13, 2020

AWS CodeBuild CI Report

aws-cdk-automation commented Feb 13, 2020

AWS CodeBuild CI Report

MrArnoldPalmer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

duarten commented Feb 14, 2020

duarten commented Feb 19, 2020

aws-cdk-automation commented Feb 19, 2020

AWS CodeBuild CI Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 22, 2020

AWS CodeBuild CI Report

aws-cdk-automation commented Feb 22, 2020

AWS CodeBuild CI Report

MrArnoldPalmer left a comment

Choose a reason for hiding this comment

mergify bot commented Feb 25, 2020

aws-cdk-automation commented Feb 25, 2020

AWS CodeBuild CI Report

mergify bot commented Feb 25, 2020

duarten commented Feb 13, 2020 •

edited

Loading