How to prevent access to certain fields in Amplify graphql public API

user_1270303 0
Viewed 290

I have a graphql model in Amplify as follows:

type Blog @model @auth(rules: [
    { allow: owner },
    { allow: groups, groups: ["admins"] },
    { allow: public, provider: apiKey, operations: [read] }
    ]){
    id: ID!
    title: String!
    content: String!
    author: String
}

I would like all field to have read access via an API key except the 'author' field.It should only be readable by owner and the 'Admin' group. I have tried all sorts of combinations of top level and field level @auth directives but it doesn't work. Does anyone knows how to solve this. Thank you

graphql aws-amplify authorization
1 Answers

have you tried using the Field Level Authorization?

type User @model {
  id: ID!
  username: String
  ssn: String @auth(rules: [{ allow: owner, ownerField: "username" }])
}

Update: My mistake, in your question it does say you tried this out.

user_8343990
Related