Data-specific Authorization with AWS Amplify & AWS Cognito

user_2526141 0
Viewed 185

Background

Hey, all. To start, I'm in the process of learning AWS Amplify / GraphQL, so I'm not sure if this is a GraphQL-specific question, or if it relates more to AWS Cognito. That said, if this question is considered off-topic, please direct me to a more appropriate place to ask this question.

The Question

Using AWS Amplify & AWS Cognito, I want the GraphQL layer to only respond with data that is specific to that entity. As an example:

Given an organization and user database structure such that many users belong to one organization, how do I ensure a user can only interact with data specific to the organization it is a part of?

More detailed Example

Given the picture below, how can I ensure user #2, when querying the AWS Amplify GraphQL layer, they will never be able to interact with organization #1's data?

Relationship Example

What I've tried

Currently, in the GraphQL layer I've manually added a WHERE clause to each query so that the client won't be able to view cross-organization data. However, this doesn't prevent any user from creating their own query to view cross-organizational data. I'm currently looking into building a custom authorization resolver, but it doesn't seem to fit my specific need yet.

Any help is greatly appreciated.

amazon-cognito-triggers graphql aws-lambda amazon-cognito amazon-web-services
1 Answers

If you want to keep to the Amplify way of doing things, you can use Authorization Rules.

Groups

If users in an organization are in the same Cognito group, then you could use Dynamic group authorization. For example:

type Sale @model @auth(rules: [{ allow: groups, groupsField: "org" }]) {
  id: ID!
  org: [String]
}

That way only sales people can only access sales who have a group/org matching their own.

Attributes

Or otherwise you can also use attributes of your users, with the ownerField directive as well.

user_40332920
Related