title: Cannot give aws-lambda access to aws-appsync API
body: <p>I am working on a project where users can upload files into a S3 bucket, these uploaded files are mapped to a GraphQL key (which was generated by Amplify CLI), and an aws-lambda function is triggered. All of this is working, but the next step I want is for this aws-lambda function to create a second file with the same ownership attributes and POST the location of the saved second file to the GraphQL API.</p>
  <p>I figured that this shouldn't be too difficult but I am having a lot of difficulty and can't understand where the problem lies.</p>
  <p><strong>BACKGROUND/DETAILS</strong></p>
  <p>I want the owner of the data (the uploader) to be the only <em>user</em> who is able to access the data, with the aws-lambda function operating in an <em>admin</em> role and able to POST/GET to API of any owner.</p>
  <p>The GraphQL schema looks like this:</p>
  <pre><code>type FileUpload @model 
  @auth(rules: [
    { allow: owner}]) {
    id: ID!
    foo: String
    bar: String
  }
  </code></pre>
  <p>And I also found this seemingly-promising AWS guide which I thought would give an IAM role <em>admin</em> access (<a href="https://docs.amplify.aws/cli/graphql/authorization-rules/#configure-custom-identity-and-group-claims" rel="nofollow noreferrer">https://docs.amplify.aws/cli/graphql/authorization-rules/#configure-custom-identity-and-group-claims</a>) which I followed by creating the file <code>amplify/backend/api/&lt;your-api-name&gt;/custom-roles.json</code> and saved it with</p>
  <pre><code>{
    &quot;adminRoleNames&quot;: [&quot;&lt;YOUR_IAM_ROLE_NAME&gt;&quot;]
  }
  </code></pre>
  <p>I replaced &quot;&lt;YOUR_IAM_ROLE_NAME&gt;&quot; with an IAM Role which I have given broad access to, including this appsync access:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;appsync:*&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>Which is the role given to my aws-lambda function.</p>
  <p>When I attempt to run a simple API query in my aws-lambda function with the above settings I get this error</p>
  <pre><code>response string:  
  {
      &quot;data&quot;: {
          &quot;getFileUpload&quot;: null
      },
      &quot;errors&quot;: [
          {
              &quot;path&quot;: [
                  &quot;getFileUpload&quot;
              ],
              &quot;data&quot;: null,
              &quot;errorType&quot;: &quot;Unauthorized&quot;,
              &quot;errorInfo&quot;: null,
              &quot;locations&quot;: [
                  {
                      &quot;line&quot;: 3,
                      &quot;column&quot;: 11,
                      &quot;sourceName&quot;: null
                  }
              ],
              &quot;message&quot;: &quot;Not Authorized to access getFileUpload on type Query&quot;
          }
      ]
  }
  </code></pre>
  <p>my actual python lambda script is</p>
  <pre><code>import http
  API_URL = '&lt;MY_API_URL&gt;'
  API_KEY = '&lt;&gt;MY_API_KEY'
  HOST = API_URL.replace('https://','').replace('/graphql','')
  
  def queryAPI():
      conn = http.client.HTTPSConnection(HOST, 443)
      headers = {
          'Content-type': 'application/graphql', 
          'x-api-key': API_KEY,
          'host': HOST
      }
  
      print('conn: ', conn)
      
      query = '''
              {
            getFileUpload(id: &quot;&lt;ID_HERE&gt;&quot;) {
              description
              createdAt
              baseFilePath
            }
          }
      '''
      graphql_query = {
          'query': query
      }
      query_data = json.dumps(graphql_query)
      print('query data: ', query_data)
      conn.request('POST', '/graphql', query_data, headers)
      response = conn.getresponse()
      response_string = response.read().decode('utf-8')
      print('response string: ', response_string)
  </code></pre>
  <p>I pass in the API key and API URL above in addition to giving AWS-lambda the IAM role. I understand that only one is probably needed, but I am trying to get the process to work then pare it back.</p>
  <p><strong>QUESTION(s)</strong></p>
  <p>As far as I understand, I am</p>
  <ol>
  <li>providing the appropriate @auth rules to my GraphQL schema based on my goals and (2 below)</li>
  <li>giving my aws-lambda function sufficient IAM authorization (via both IAM role and API key) to override any potential restrictive @auth rules of my GraphQL schema</li>
  </ol>
  <p>But clearly something is not working. Can anyone point me towards a problem that I am overlooking?</p>