Aws-cdk: AppSync: support for OPENID_CONNECT authorization type

Created on 14 May 2020 · 5Comments · Source: aws/aws-cdk

Currently it is not possible to configure the OPENID_CONNECT authentication method with the GraphQLApi object.

Proposed Solution

Currently this is only possible with the primitive Cfn objects. This means that it makes configuring subsequent schemas, datasources and resolvers more complex as they too need to use the primitive Cfn objects. Below is an example of achieving this using the primitive Cfn objects. I believe the addition needs to be made in a similar way to this https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-appsync/lib/graphqlapi.ts#L31.

Cfn implementation

auth_config = aws_appsync.CfnGraphQLApi.OpenIDConnectConfigProperty(
    issuer="https://openid_privider.company.com/"
)

api = aws_appsync.CfnGraphQLApi(
    self,
    id="api",
    name="api",
    log_config=aws_appsync.CfnGraphQLApi.LogConfigProperty(
        exclude_verbose_content=False,
        cloud_watch_logs_role_arn=log_role.role_arn,
        field_log_level="ALL",
    ),
    open_id_connect_config=auth_config,
    authentication_type="OPENID_CONNECT",
)

[ ] :wave: I may be able to implement this feature request
[ ] :warning: This feature might incur a breaking change

This is a :rocket: Feature Request

@aws-cdaws-appsync feature-request needs-triage

Source