AppSync GraphQL Subscription to group data

Question

I have implemented an AWS Lambda authorization layer for my GraphQL queries and mutations, such that a user may only read/write data to a particular DynamoDB table item iff they are a member of the group that the item belongs to, implemented using a groupId partition key and a sort key of itemId. So that the table can have many itemIds with a common groupId, and also many different groupIds. This all works as expected.

Now I would like to be able to extend this group authorization to my real time GraphQL subscriptions. I observe that unparameterized subscriptions broadcast to all users. I need a solution that constrains the subscription events such that all group members and only group members receive the subscription event for mutations on table data containing the corresponding groupID key. A user, being a member of many groups, will receive subscription events for all groups that they are a member of.

The groups and group members are dynamic, with groups being created and members being added by application business logic.

I observe a multitude of AWS authorization techniques, static and dynamic. I have seen examples of parameterized subscriptions and subscription resolvers that target subscribing only to one item, but nothing that I can see that fits my particular 'multi-group' need.

I am using AWS Amplify API for client GraphQL calls. I observe Apollo has a subscribeToMore() that might be helpful for this scenario, but I presently prefer to stay away from the rework required for me to fit my UI into Apollo 2's Render Props pattern.

Any thoughts?

Answer 1

You can do the following to enable this use-case with AppSync.

1. Add a "groupId" argument to your subscription.
2. Attach a subscription resolver to your subscription.
3. In the subscription resolver's request mapping template, query the User table to determine which groups the caller is authorized for.
4. In the subscription response mapping template, cross-check the subscription "groupId" argument with the list of groups you retrieved from your User's table query. Reject the request if the caller is attempting to subscribe to a group they are not authorized for.
5. Make sure your mutation returns a groupId field so AppSync's subscriptions can properly route your messages.

You can then have a client subscribe multiple times, once for each group they want notifications for.

Here is the subscription authorization documentation which contains an example which is similar to yours: https://docs.aws.amazon.com/appsync/latest/devguide/security-authorization-use-cases.html#real-time-data