So i have a post confirmation trigger in AWS cognito that inserts a signed up user into my dynamoDB table.
Issue is that im using AWS Amplify & AppSync to query that table via graphql. There are @auth directives that i want to add onto this table to allow only the actual user to edit their user metadata in dynamoDB. My question is, who is the owner of that record if it was actually created via the post confirmation lambda function?
Such information is not stored in the record itself. So who uploaded a record into DynamoDB (DDB) database is not something that DDB checks and enforces. For that you would have to design a custom solution, a keep a separate attribute in the record indicating entity that created the record through your app.
However, DDB allows for granular IAM access control to individual records or even its attributes. This could allow you to craft IAM policies that allow access to individual users only, through IAM substitution variables, e.g. ${www.amazon.com:user_id}.
