diff --git a/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts b/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts
index 554bc3be77464..effa59310b6bc 100644
--- a/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts
+++ b/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts
@@ -531,7 +531,7 @@ export class GraphQLApi extends GraphqlApiBase {
       userPoolId: config.userPool.userPoolId,
       awsRegion: config.userPool.stack.region,
       appIdClientRegex: config.appIdClientRegex,
-      defaultAction: config.defaultAction,
+      defaultAction: config.defaultAction || UserPoolDefaultAction.ALLOW,
     };
   }
 
diff --git a/packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts b/packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts
index e9ad68e4e66e0..fabde1d59c95e 100644
--- a/packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts
+++ b/packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts
@@ -250,6 +250,7 @@ describe('AppSync User Pool Authorization', () => {
       AuthenticationType: 'AMAZON_COGNITO_USER_POOLS',
       UserPoolConfig: {
         AwsRegion: { Ref: 'AWS::Region' },
+        DefaultAction: 'ALLOW',
         UserPoolId: { Ref: 'pool056F3F7E' },
       },
     });
@@ -371,6 +372,7 @@ describe('AppSync User Pool Authorization', () => {
       AuthenticationType: 'AMAZON_COGNITO_USER_POOLS',
       UserPoolConfig: {
         AwsRegion: { Ref: 'AWS::Region' },
+        DefaultAction: 'ALLOW',
         UserPoolId: { Ref: 'pool056F3F7E' },
       },
       AdditionalAuthenticationProviders: [
diff --git a/packages/@aws-cdk/aws-appsync/test/integ.graphql.ts b/packages/@aws-cdk/aws-appsync/test/integ.graphql.ts
index 715864b209bc1..9882fead1cf12 100644
--- a/packages/@aws-cdk/aws-appsync/test/integ.graphql.ts
+++ b/packages/@aws-cdk/aws-appsync/test/integ.graphql.ts
@@ -9,7 +9,6 @@ import {
   MappingTemplate,
   PrimaryKey,
   Schema,
-  UserPoolDefaultAction,
   Values,
 } from '../lib';
 
@@ -42,7 +41,6 @@ const api = new GraphQLApi(stack, 'Api', {
       authorizationType: AuthorizationType.USER_POOL,
       userPoolConfig: {
         userPool,
-        defaultAction: UserPoolDefaultAction.ALLOW,
       },
     },
     additionalAuthorizationModes: [