title: AWS Amplify @auth rule require multiple group membership
body: <p>Is it possible to have auth rules requiring authenticated users to belong to multiple groups? For example &quot;allow  users who are in 'Tenant N' AND who are 'Editors'&quot;.</p>
  <p>Our models are currently similar to this:</p>
  <pre><code>type MyModel
    @model
    @auth(rules: [
      { allow: owner },
      { allow: groups, groupsField: &quot;tenantID&quot; },
    ])
  {
    id: ID!
    tenantID: String!
  }
  </code></pre>
  <p>So using static group auth doesn't work for us:</p>
  <pre><code>type MyModel
    @model
    @auth(rules: [
      { allow: groups, groups: [&quot;DynamicTenantId&quot;, &quot;Editor&quot;] }
    ])
  {
    id: ID!
    tenantID: String!
  }
  </code></pre>
  <p>Because tenantID is a dynamic value, we need to use dynamic group auth instead:</p>
  <pre><code>type MyModel
    @model
    @auth(rules: [
      { allow: owner },
      { allow: groups, groupsField: &quot;tenantID&quot; },
      { allow: groups, group: &quot;Editor&quot; },
    ])
  {
    id: ID!
    tenantID: String!
  }
  </code></pre>
  <p>But this doesn't work because it's an &quot;OR&quot;, saying &quot;allow anyone in the tenant OR anyone with the 'Editor' group&quot;.</p>
  <p>Updating our models to use single dynamic group auth field doesn't work either:</p>
  <pre><code>type MyModel
    @model
    @auth(rules: [
      { allow: owner },
      { allow: groups, groupsField: &quot;allowGroups&quot; },
    ])
  {
    id: ID!
    allowGroups: [String] # ['DynamicTenantId', 'Editor']
  }
  </code></pre>
  <p>Because this an &quot;OR&quot; too, saying &quot;allow anyone in the tenant OR anyone with the 'Editor' group&quot;.</p>
  <p>Are there any other options, aside from a custom authenticator, to require multiple group membership?</p>