Aws-cdk: AWS_IAM as additional authorization provider for AppSync

[akrsmv]

following the issue for providing API_KEY as an AuthMode, I would like to ask/request how to implement AWS_IAM as additional auth provider via CDK

Use Case

please see following example i struggle with:

this.graphQLApi = new appsync.GraphQLApi(this, 'AppSync', {
        name: 'AppSync',
        schemaDefinition: '...',
        authorizationConfig: {
            defaultAuthorization: {
                userPool: props.cognitoConstruct.userPool,
                defaultAction: appsync.UserPoolDefaultAction.ALLOW
            },
            additionalAuthorizationModes:[
                {
                    // TODO how to add AWS_IAM as AuthMode here 
                }
            ]
        }
    });

Thanks!

[thaerlabs]

@akrsmv I found a solution but it's not very clean, as the api property of the appsync.GraphQLApi which points to CfnGraphQLApi is marked as private, so in theory it's not accessible. But, because of javascript not having any notion of private properties, it's still accessible through this.graphQLApi.api, although typescript might complain, it works.

Which means you can do something like this:

this.graphQLApi.api.additionalAuthenticationProviders.push({
  authenticationType: 'AWS_IAM',
});

you'll end up with an output like this:

{
  "GraphQLApi6F81E747": {
    "Type": "AWS::AppSync::GraphQLApi",
    "Properties": {
      "AuthenticationType": "AMAZON_COGNITO_USER_POOLS",
      "Name": "AppSync",
      "AdditionalAuthenticationProviders": [
        {
          "AuthenticationType": "AWS_IAM" // this is what we need
        }
      ],
      "LogConfig": {
        "CloudWatchLogsRoleArn": {
          "Fn::GetAtt": [
            "GraphQLApiApiLogsRoleA56C304B",
            "Arn"
          ]
        },
        "FieldLogLevel": "ALL"
      },
      "UserPoolConfig": {
        "AwsRegion": {
          "Ref": "AWS::Region"
        },
        "DefaultAction": "ALLOW",
        "UserPoolId": {
          "Ref": "UserPool6BA7E5F2"
        }
      }
    },
    "Metadata": {
      "aws:cdk:path": "reapet-app-dev/GraphQLApi/Resource"
    }
  }
}

Works for now, until AWS_IAM gets added to the GraphQLApi construct.

[akrsmv]

@thaerlabs Thanks!
Typescript indeed complained because of the private access, however, with below code it worked:

((this.graphQLApi.node.defaultChild as CfnGraphQLApi).additionalAuthenticationProviders as Array<CfnGraphQLApi.AdditionalAuthenticationProviderProperty>).push({ authenticationType: 'AWS_IAM', });

[BryanPan342]

Closing in favor of #6772