feat(appsync): allow specifying additional authorization modes

Currently the AppSync L2 constructs don't provide a way to configure additional authorization modes. Add the ability to specify additional authorization modes, currently limited to Cognito user pools and API keys. Fixes aws#6247 Signed-off-by: Duarte Nunes <[email protected]>
duarten · Feb 13, 2020 · f3f9c16 · f3f9c16
1 parent 5084369
commit f3f9c16
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/packages/@aws-cdk/aws-appsync/README.md b/packages/@aws-cdk/aws-appsync/README.md
@@ -64,6 +64,11 @@ export class ApiStack extends Stack {
           userPool,
           defaultAction: UserPoolDefaultAction.ALLOW,
         },
+        additionalAuthorizationModes: [
+          {
+            apiKeyDesc: 'My API Key',
+          },
+        ],
       },
       schemaDefinitionFile: './schema.graphql',
     });

diff --git a/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts b/packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts
@@ -80,6 +80,13 @@ export interface AuthorizationConfig {
      * @default - API Key authorization
      */
     readonly defaultAuthorization?: AuthModes;
+
+    /**
+     * Additional authorization modes
+     *
+     * @default - No other modes
+     */
+    readonly additionalAuthorizationModes?: [AuthModes]
 }
 
 /**
@@ -267,6 +274,15 @@ export class GraphQLApi extends Construct {
         } else if (isApiKeyConfig(auth.defaultAuthorization)) {
             this.api.authenticationType = this.apiKeyDesc(auth.defaultAuthorization).authenticationType;
         }
+
+        this.api.additionalAuthenticationProviders = [];
+        for (const mode of (auth.additionalAuthorizationModes || [])) {
+            if (isUserPoolConfig(mode)) {
+                this.api.additionalAuthenticationProviders.push(this.userPoolDescFrom(mode));
+            } else if (isApiKeyConfig(mode)) {
+                this.api.additionalAuthenticationProviders.push(this.apiKeyDesc(mode));
+            }
+        }
     }
 
     private userPoolDescFrom(upConfig: UserPoolConfig): { authenticationType: string; userPoolConfig: CfnGraphQLApi.UserPoolConfigProperty } {