@@ -22,9 +22,52 @@ export enum AuthenticationType {
22
22
AMAZON_COGNITO_USER_POOLS = "AMAZON_COGNITO_USER_POOLS" ,
23
23
API_KEY = "API_KEY" ,
24
24
AWS_IAM = "AWS_IAM" ,
25
+ AWS_LAMBDA = "AWS_LAMBDA" ,
25
26
OPENID_CONNECT = "OPENID_CONNECT" ,
26
27
}
27
28
29
+ /**
30
+ * <p>A <code>LambdaAuthorizerConfig</code> holds configuration on how to authorize AppSync API access when using
31
+ * the <code>AWS_LAMBDA</code> authorizer mode. Be aware that an AppSync API may have only one Lambda authorizer configured
32
+ * at a time.</p>
33
+ */
34
+ export interface LambdaAuthorizerConfig {
35
+ /**
36
+ * <p>The number of seconds a response should be cached for. The default is 5 minutes (300 seconds).
37
+ * The Lambda function can override this by returning a
38
+ * <code>ttlOverride</code> key in its response. A value of 0 disables caching of
39
+ * responses.</p>
40
+ */
41
+ authorizerResultTtlInSeconds ?: number ;
42
+
43
+ /**
44
+ * <p>The ARN of the lambda function to be called for authorization. This may be a standard
45
+ * Lambda ARN, a version ARN (<code>.../v3</code>) or alias ARN. </p>
46
+ * <p>
47
+ * <i>Note</i>: This Lambda function must have the following resource-based
48
+ * policy assigned to it. When configuring Lambda authorizers in the Console, this is done for
49
+ * you. To do so with the AWS CLI, run the following:</p>
50
+ * <p>
51
+ * <code>aws lambda add-permission --function-name "arn:aws:lambda:us-east-2:111122223333:function:my-function" --statement-id "appsync" --principal appsync.amazonaws.com --action lambda:InvokeFunction</code>
52
+ * </p>
53
+ */
54
+ authorizerUri : string | undefined ;
55
+
56
+ /**
57
+ * <p>A regular expression for validation of tokens before the Lambda Function is called.</p>
58
+ */
59
+ identityValidationExpression ?: string ;
60
+ }
61
+
62
+ export namespace LambdaAuthorizerConfig {
63
+ /**
64
+ * @internal
65
+ */
66
+ export const filterSensitiveLog = ( obj : LambdaAuthorizerConfig ) : any => ( {
67
+ ...obj ,
68
+ } ) ;
69
+ }
70
+
28
71
/**
29
72
* <p>Describes an OpenID Connect configuration.</p>
30
73
*/
@@ -38,7 +81,7 @@ export interface OpenIDConnectConfig {
38
81
/**
39
82
* <p>The client identifier of the Relying party at the OpenID identity provider. This
40
83
* identifier is typically obtained when the Relying party is registered with the OpenID
41
- * identity provider. You can specify a regular expression so the AWS AppSync can validate
84
+ * identity provider. You can specify a regular expression so the AppSync can validate
42
85
* against multiple client identifiers at a time.</p>
43
86
*/
44
87
clientId ?: string ;
@@ -73,7 +116,7 @@ export interface CognitoUserPoolConfig {
73
116
userPoolId : string | undefined ;
74
117
75
118
/**
76
- * <p>The AWS Region in which the user pool was created.</p>
119
+ * <p>The Amazon Web Services Region in which the user pool was created.</p>
77
120
*/
78
121
awsRegion : string | undefined ;
79
122
@@ -98,7 +141,7 @@ export namespace CognitoUserPoolConfig {
98
141
*/
99
142
export interface AdditionalAuthenticationProvider {
100
143
/**
101
- * <p>The authentication type: API key, AWS IAM , OIDC, or Amazon Cognito user pools.</p>
144
+ * <p>The authentication type: API key, Identity and Access Management , OIDC, or Amazon Cognito user pools.</p>
102
145
*/
103
146
authenticationType ?: AuthenticationType | string ;
104
147
@@ -111,6 +154,11 @@ export interface AdditionalAuthenticationProvider {
111
154
* <p>The Amazon Cognito user pool configuration.</p>
112
155
*/
113
156
userPoolConfig ?: CognitoUserPoolConfig ;
157
+
158
+ /**
159
+ * <p>Configuration for AWS Lambda function authorization.</p>
160
+ */
161
+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
114
162
}
115
163
116
164
export namespace AdditionalAuthenticationProvider {
@@ -313,7 +361,7 @@ export namespace ApiCache {
313
361
314
362
/**
315
363
* <p>Describes an API key.</p>
316
- * <p>Customers invoke AWS AppSync GraphQL API operations with API keys as an identity
364
+ * <p>Customers invoke AppSync GraphQL API operations with API keys as an identity
317
365
* mechanism. There are two key versions:</p>
318
366
* <p>
319
367
* <b>da1</b>: This version was introduced at launch in November
@@ -474,16 +522,16 @@ export enum AuthorizationType {
474
522
}
475
523
476
524
/**
477
- * <p>The AWS IAM configuration.</p>
525
+ * <p>The Identity and Access Management configuration.</p>
478
526
*/
479
527
export interface AwsIamConfig {
480
528
/**
481
- * <p>The signing region for AWS IAM authorization.</p>
529
+ * <p>The signing region for Identity and Access Management authorization.</p>
482
530
*/
483
531
signingRegion ?: string ;
484
532
485
533
/**
486
- * <p>The signing service name for AWS IAM authorization.</p>
534
+ * <p>The signing service name for Identity and Access Management authorization.</p>
487
535
*/
488
536
signingServiceName ?: string ;
489
537
}
@@ -514,7 +562,7 @@ export interface AuthorizationConfig {
514
562
authorizationType : AuthorizationType | string | undefined ;
515
563
516
564
/**
517
- * <p>The AWS IAM settings.</p>
565
+ * <p>The Identity and Access Management settings.</p>
518
566
*/
519
567
awsIamConfig ?: AwsIamConfig ;
520
568
}
@@ -717,7 +765,7 @@ export namespace CreateApiCacheResponse {
717
765
}
718
766
719
767
/**
720
- * <p>An internal AWS AppSync error occurred. Try your request again.</p>
768
+ * <p>An internal AppSync error occurred. Try your request again.</p>
721
769
*/
722
770
export interface InternalFailureException extends __SmithyException , $MetadataBearer {
723
771
name : "InternalFailureException" ;
@@ -872,7 +920,7 @@ export interface DynamodbDataSourceConfig {
872
920
tableName : string | undefined ;
873
921
874
922
/**
875
- * <p>The AWS Region.</p>
923
+ * <p>The Amazon Web Services Region.</p>
876
924
*/
877
925
awsRegion : string | undefined ;
878
926
@@ -911,7 +959,7 @@ export interface ElasticsearchDataSourceConfig {
911
959
endpoint : string | undefined ;
912
960
913
961
/**
914
- * <p>The AWS Region.</p>
962
+ * <p>The Amazon Web Services Region.</p>
915
963
*/
916
964
awsRegion : string | undefined ;
917
965
}
@@ -931,8 +979,7 @@ export namespace ElasticsearchDataSourceConfig {
931
979
export interface HttpDataSourceConfig {
932
980
/**
933
981
* <p>The HTTP URL endpoint. You can either specify the domain name or IP, and port
934
- * combination, and the URL scheme must be HTTP or HTTPS. If the port is not specified, AWS
935
- * AppSync uses the default port 80 for the HTTP endpoint and port 443 for HTTPS
982
+ * combination, and the URL scheme must be HTTP or HTTPS. If the port is not specified, AppSync uses the default port 80 for the HTTP endpoint and port 443 for HTTPS
936
983
* endpoints.</p>
937
984
*/
938
985
endpoint ?: string ;
@@ -953,7 +1000,7 @@ export namespace HttpDataSourceConfig {
953
1000
}
954
1001
955
1002
/**
956
- * <p>Describes an AWS Lambda data source configuration.</p>
1003
+ * <p>Describes an Amazon Web Services Lambda data source configuration.</p>
957
1004
*/
958
1005
export interface LambdaDataSourceConfig {
959
1006
/**
@@ -976,7 +1023,7 @@ export namespace LambdaDataSourceConfig {
976
1023
*/
977
1024
export interface RdsHttpEndpointConfig {
978
1025
/**
979
- * <p>AWS Region for RDS HTTP endpoint.</p>
1026
+ * <p>Amazon Web Services Region for RDS HTTP endpoint.</p>
980
1027
*/
981
1028
awsRegion ?: string ;
982
1029
@@ -996,7 +1043,7 @@ export interface RdsHttpEndpointConfig {
996
1043
schema ?: string ;
997
1044
998
1045
/**
999
- * <p>AWS secret store ARN for database credentials.</p>
1046
+ * <p>Amazon Web Services secret store ARN for database credentials.</p>
1000
1047
*/
1001
1048
awsSecretStoreArn ?: string ;
1002
1049
}
@@ -1076,7 +1123,7 @@ export interface CreateDataSourceRequest {
1076
1123
type : DataSourceType | string | undefined ;
1077
1124
1078
1125
/**
1079
- * <p>The AWS IAM service role ARN for the data source. The system assumes this role when
1126
+ * <p>The Identity and Access Management service role ARN for the data source. The system assumes this role when
1080
1127
* accessing the data source.</p>
1081
1128
*/
1082
1129
serviceRoleArn ?: string ;
@@ -1087,7 +1134,7 @@ export interface CreateDataSourceRequest {
1087
1134
dynamodbConfig ?: DynamodbDataSourceConfig ;
1088
1135
1089
1136
/**
1090
- * <p>AWS Lambda settings.</p>
1137
+ * <p>Amazon Web Services Lambda settings.</p>
1091
1138
*/
1092
1139
lambdaConfig ?: LambdaDataSourceConfig ;
1093
1140
@@ -1150,7 +1197,7 @@ export interface DataSource {
1150
1197
* </li>
1151
1198
* <li>
1152
1199
* <p>
1153
- * <b>AWS_LAMBDA</b>: The data source is an AWS Lambda
1200
+ * <b>AWS_LAMBDA</b>: The data source is an Amazon Web Services Lambda
1154
1201
* function.</p>
1155
1202
* </li>
1156
1203
* <li>
@@ -1175,7 +1222,7 @@ export interface DataSource {
1175
1222
type ?: DataSourceType | string ;
1176
1223
1177
1224
/**
1178
- * <p>The AWS IAM service role ARN for the data source. The system assumes this role when
1225
+ * <p>The Identity and Access Management service role ARN for the data source. The system assumes this role when
1179
1226
* accessing the data source.</p>
1180
1227
*/
1181
1228
serviceRoleArn ?: string ;
@@ -1186,7 +1233,7 @@ export interface DataSource {
1186
1233
dynamodbConfig ?: DynamodbDataSourceConfig ;
1187
1234
1188
1235
/**
1189
- * <p>AWS Lambda settings.</p>
1236
+ * <p>Amazon Web Services Lambda settings.</p>
1190
1237
*/
1191
1238
lambdaConfig ?: LambdaDataSourceConfig ;
1192
1239
@@ -1515,7 +1562,7 @@ export interface LogConfig {
1515
1562
fieldLogLevel : FieldLogLevel | string | undefined ;
1516
1563
1517
1564
/**
1518
- * <p>The service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in
1565
+ * <p>The service role that AppSync will assume to publish to Amazon CloudWatch logs in
1519
1566
* your account. </p>
1520
1567
*/
1521
1568
cloudWatchLogsRoleArn : string | undefined ;
@@ -1551,7 +1598,7 @@ export interface UserPoolConfig {
1551
1598
userPoolId : string | undefined ;
1552
1599
1553
1600
/**
1554
- * <p>The AWS Region in which the user pool was created.</p>
1601
+ * <p>The Amazon Web Services Region in which the user pool was created.</p>
1555
1602
*/
1556
1603
awsRegion : string | undefined ;
1557
1604
@@ -1590,7 +1637,7 @@ export interface CreateGraphqlApiRequest {
1590
1637
logConfig ?: LogConfig ;
1591
1638
1592
1639
/**
1593
- * <p>The authentication type: API key, AWS IAM , OIDC, or Amazon Cognito user pools.</p>
1640
+ * <p>The authentication type: API key, Identity and Access Management , OIDC, or Amazon Cognito user pools.</p>
1594
1641
*/
1595
1642
authenticationType : AuthenticationType | string | undefined ;
1596
1643
@@ -1620,6 +1667,11 @@ export interface CreateGraphqlApiRequest {
1620
1667
* <code>GraphqlApi</code>.</p>
1621
1668
*/
1622
1669
xrayEnabled ?: boolean ;
1670
+
1671
+ /**
1672
+ * <p>Configuration for AWS Lambda function authorization.</p>
1673
+ */
1674
+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
1623
1675
}
1624
1676
1625
1677
export namespace CreateGraphqlApiRequest {
@@ -1693,10 +1745,16 @@ export interface GraphqlApi {
1693
1745
xrayEnabled ?: boolean ;
1694
1746
1695
1747
/**
1696
- * <p>The ARN of the AWS Web Application Firewall ( WAF) ACL associated with this
1748
+ * <p>The ARN of the WAF ACL associated with this
1697
1749
* <code>GraphqlApi</code>, if one exists.</p>
1698
1750
*/
1699
1751
wafWebAclArn ?: string ;
1752
+
1753
+ /**
1754
+ * <p></p>
1755
+ * <p>Configuration for AWS Lambda function authorization.</p>
1756
+ */
1757
+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
1700
1758
}
1701
1759
1702
1760
export namespace GraphqlApi {
@@ -3344,7 +3402,7 @@ export interface UpdateDataSourceRequest {
3344
3402
dynamodbConfig ?: DynamodbDataSourceConfig ;
3345
3403
3346
3404
/**
3347
- * <p>The new AWS Lambda configuration.</p>
3405
+ * <p>The new Amazon Web Services Lambda configuration.</p>
3348
3406
*/
3349
3407
lambdaConfig ?: LambdaDataSourceConfig ;
3350
3408
@@ -3509,6 +3567,11 @@ export interface UpdateGraphqlApiRequest {
3509
3567
* <code>GraphqlApi</code>.</p>
3510
3568
*/
3511
3569
xrayEnabled ?: boolean ;
3570
+
3571
+ /**
3572
+ * <p>Configuration for AWS Lambda function authorization.</p>
3573
+ */
3574
+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
3512
3575
}
3513
3576
3514
3577
export namespace UpdateGraphqlApiRequest {
0 commit comments