Amplify-cli: Can you programmatically refresh and retrieve an API key?

[no-creative-name]

Which Category is your question related to?
Amplify API

Amplify CLI Version
3.0.10
You can use amplify -v to check the amplify cli version on your system

What AWS Services are you utilizing?
Amplify

Provide additional details e.g. code snippets
In my current project I wanted to implement a public API with "amplify add api". As authorization method I chose API key, since anything else would bring much unneeded overhead. I set the API key expiration date to 365 days, but still I'd need a way to refresh the key on a regular basis automatically.
Can you refresh the API key from the frontend or via a Lambda function without having to do sth manually in the AWS UI?

[no-creative-name]

I don't know if this is allowed, but I'd like to push this issue, since the project is in a critical phase right now and I'd need to know if and how you could achieve a public API without Cognito and IAM and without the need of a human actually refreshing the API key. Can s/o help please?

[SwaySway]

Hello @no-creative-name
A current workaround would be to toggle CreateAPIKey when you need to refresh your API key.
Docs here: https://docs.amplify.aws/cli/graphql-transformer/config-params#createapikey

[no-creative-name]

Thanks @SwaySway. So am I right in assuming that you can't create a long-lasting public API purely with the Amplify CLI and without the need to manually adjust something in the AWS UI?

[no-creative-name]

@SwaySway can you please answer? Because then I'd know if we have to find another solution than Amplify for this.

[no-creative-name]

My solution for now is to create a scheduled Lambda function that triggers an Amplify Console build through a webhook every year. Correct me if I'm wrong, but this seems to be the most efficient solution for my problem. If so, please close this issue. 🙂

[SwaySway]

@no-creative-name
If your workflow is coming from the CLI then using the lambda function which triggers the build would one solution to rotating the keys. This is something we are aware of as AppSync itself does not currently have an option to rotate the API key. Should you change the value in the AppSync console itself could cause issues as the CLI does not pull changes made to the resources themselves.

I'm going to close this issue for now and review this with the team.

[dylan-authentic]

Hey @SwaySway -- Just wondering if there is a simple way to update my AppSync API key on the frontend using the CLI? I've updated the key on the AppSync console, but currently running amplify pull or amplify env pull doesn't overwrite the aws-exports.js file with the new API key. Is the solution to manually update the aws-exports.js file with the new key every time it expires?