GraphQLApi

Provides an AppSync GraphQL API.

Example Usage

API Key Authentication

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AuthenticationType = "API_KEY",
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AuthenticationType: pulumi.String("API_KEY"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example", authentication_type="API_KEY")

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    authenticationType: "API_KEY",
});

AWS Cognito User Pool Authentication

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AuthenticationType = "AMAZON_COGNITO_USER_POOLS",
            UserPoolConfig = new Aws.AppSync.Inputs.GraphQLApiUserPoolConfigArgs
            {
                AwsRegion = data.Aws_region.Current.Name,
                DefaultAction = "DENY",
                UserPoolId = aws_cognito_user_pool.Example.Id,
            },
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AuthenticationType: pulumi.String("AMAZON_COGNITO_USER_POOLS"),
            UserPoolConfig: &appsync.GraphQLApiUserPoolConfigArgs{
                AwsRegion:     pulumi.String(data.Aws_region.Current.Name),
                DefaultAction: pulumi.String("DENY"),
                UserPoolId:    pulumi.String(aws_cognito_user_pool.Example.Id),
            },
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example",
    authentication_type="AMAZON_COGNITO_USER_POOLS",
    user_pool_config={
        "awsRegion": data["aws_region"]["current"]["name"],
        "default_action": "DENY",
        "user_pool_id": aws_cognito_user_pool["example"]["id"],
    })

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    authenticationType: "AMAZON_COGNITO_USER_POOLS",
    userPoolConfig: {
        awsRegion: aws_region_current.name,
        defaultAction: "DENY",
        userPoolId: aws_cognito_user_pool_example.id,
    },
});

AWS IAM Authentication

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AuthenticationType = "AWS_IAM",
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AuthenticationType: pulumi.String("AWS_IAM"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example", authentication_type="AWS_IAM")

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    authenticationType: "AWS_IAM",
});

With Schema

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AuthenticationType = "AWS_IAM",
            Schema = @"schema {
 query: Query
}
type Query {
  test: Int
}

",
        });
    }

}

package main

import (
    "fmt"

    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AuthenticationType: pulumi.String("AWS_IAM"),
            Schema: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v", "schema {\n", "  query: Query\n", "}\n", "type Query {\n", "  test: Int\n", "}\n", "\n")),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example",
    authentication_type="AWS_IAM",
    schema="""schema {
    query: Query
}
type Query {
  test: Int
}

""")

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    authenticationType: "AWS_IAM",
    schema: `schema {
    query: Query
}
type Query {
  test: Int
}
`,
});

OpenID Connect Authentication

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AuthenticationType = "OPENID_CONNECT",
            OpenidConnectConfig = new Aws.AppSync.Inputs.GraphQLApiOpenidConnectConfigArgs
            {
                Issuer = "https://example.com",
            },
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AuthenticationType: pulumi.String("OPENID_CONNECT"),
            OpenidConnectConfig: &appsync.GraphQLApiOpenidConnectConfigArgs{
                Issuer: pulumi.String("https://example.com"),
            },
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example",
    authentication_type="OPENID_CONNECT",
    openid_connect_config={
        "issuer": "https://example.com",
    })

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    authenticationType: "OPENID_CONNECT",
    openidConnectConfig: {
        issuer: "https://example.com",
    },
});

With Multiple Authentication Providers

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var example = new Aws.AppSync.GraphQLApi("example", new Aws.AppSync.GraphQLApiArgs
        {
            AdditionalAuthenticationProviders = 
            {
                new Aws.AppSync.Inputs.GraphQLApiAdditionalAuthenticationProviderArgs
                {
                    AuthenticationType = "AWS_IAM",
                },
            },
            AuthenticationType = "API_KEY",
        });
    }

}

package main

import (
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        _, err := appsync.NewGraphQLApi(ctx, "example", &appsync.GraphQLApiArgs{
            AdditionalAuthenticationProviders: appsync.GraphQLApiAdditionalAuthenticationProviderArray{
                &appsync.GraphQLApiAdditionalAuthenticationProviderArgs{
                    AuthenticationType: pulumi.String("AWS_IAM"),
                },
            },
            AuthenticationType: pulumi.String("API_KEY"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example = aws.appsync.GraphQLApi("example",
    additional_authentication_providers=[{
        "authentication_type": "AWS_IAM",
    }],
    authentication_type="API_KEY")

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.appsync.GraphQLApi("example", {
    additionalAuthenticationProviders: [{
        authenticationType: "AWS_IAM",
    }],
    authenticationType: "API_KEY",
});

Enabling Logging

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var exampleRole = new Aws.Iam.Role("exampleRole", new Aws.Iam.RoleArgs
        {
            AssumeRolePolicy = @"{
    ""Version"": ""2012-10-17"",
    ""Statement"": [
        {
        ""Effect"": ""Allow"",
        ""Principal"": {
            ""Service"": ""appsync.amazonaws.com""
        },
        ""Action"": ""sts:AssumeRole""
        }
    ]
}

",
        });
        var exampleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("exampleRolePolicyAttachment", new Aws.Iam.RolePolicyAttachmentArgs
        {
            PolicyArn = "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
            Role = exampleRole.Name,
        });
        var exampleGraphQLApi = new Aws.AppSync.GraphQLApi("exampleGraphQLApi", new Aws.AppSync.GraphQLApiArgs
        {
            LogConfig = new Aws.AppSync.Inputs.GraphQLApiLogConfigArgs
            {
                CloudwatchLogsRoleArn = exampleRole.Arn,
                FieldLogLevel = "ERROR",
            },
        });
    }

}

package main

import (
    "fmt"

    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/appsync"
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/iam"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        exampleRole, err := iam.NewRole(ctx, "exampleRole", &iam.RoleArgs{
            AssumeRolePolicy: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", "    \"Version\": \"2012-10-17\",\n", "    \"Statement\": [\n", "        {\n", "        \"Effect\": \"Allow\",\n", "        \"Principal\": {\n", "            \"Service\": \"appsync.amazonaws.com\"\n", "        },\n", "        \"Action\": \"sts:AssumeRole\"\n", "        }\n", "    ]\n", "}\n", "\n")),
        })
        if err != nil {
            return err
        }
        _, err = iam.NewRolePolicyAttachment(ctx, "exampleRolePolicyAttachment", &iam.RolePolicyAttachmentArgs{
            PolicyArn: pulumi.String("arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"),
            Role:      exampleRole.Name,
        })
        if err != nil {
            return err
        }
        _, err = appsync.NewGraphQLApi(ctx, "exampleGraphQLApi", &appsync.GraphQLApiArgs{
            LogConfig: &appsync.GraphQLApiLogConfigArgs{
                CloudwatchLogsRoleArn: exampleRole.Arn,
                FieldLogLevel:         pulumi.String("ERROR"),
            },
        })
        if err != nil {
            return err
        }
        return nil
    })
}

import pulumi
import pulumi_aws as aws

example_role = aws.iam.Role("exampleRole", assume_role_policy="""{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Principal": {
            "Service": "appsync.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
        }
    ]
}

""")
example_role_policy_attachment = aws.iam.RolePolicyAttachment("exampleRolePolicyAttachment",
    policy_arn="arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
    role=example_role.name)
example_graph_ql_api = aws.appsync.GraphQLApi("exampleGraphQLApi", log_config={
    "cloudwatchLogsRoleArn": example_role.arn,
    "fieldLogLevel": "ERROR",
})

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleRole = new aws.iam.Role("example", {
    assumeRolePolicy: `{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Principal": {
            "Service": "appsync.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
        }
    ]
}
`,
});
const exampleRolePolicyAttachment = new aws.iam.RolePolicyAttachment("example", {
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
    role: exampleRole.name,
});
const exampleGraphQLApi = new aws.appsync.GraphQLApi("example", {
    logConfig: {
        cloudwatchLogsRoleArn: exampleRole.arn,
        fieldLogLevel: "ERROR",
    },
});

Create a GraphQLApi Resource

new GraphQLApi(name: string, args: GraphQLApiArgs, opts?: CustomResourceOptions);

def GraphQLApi(resource_name, opts=None, additional_authentication_providers=None, authentication_type=None, log_config=None, name=None, openid_connect_config=None, schema=None, tags=None, user_pool_config=None, xray_enabled=None, __props__=None);

func NewGraphQLApi(ctx *Context, name string, args GraphQLApiArgs, opts ...ResourceOption) (*GraphQLApi, error)

public GraphQLApi(string name, GraphQLApiArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args GraphQLApiArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args GraphQLApiArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args GraphQLApiArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

GraphQLApi Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The GraphQLApi resource accepts the following input properties:

AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
AdditionalAuthenticationProviders List<GraphQLApiAdditionalAuthenticationProviderArgs>: One or more additional authentication providers for the GraphqlApi. Defined below.
LogConfig GraphQLApiLogConfigArgs: Nested argument containing logging configuration. Defined below.
Name string: A user-supplied name for the GraphqlApi.
OpenidConnectConfig GraphQLApiOpenidConnectConfigArgs: Nested argument containing OpenID Connect configuration. Defined below.
Schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
Tags Dictionary<string, string>: A map of tags to assign to the resource.
UserPoolConfig GraphQLApiUserPoolConfigArgs: The Amazon Cognito User Pool configuration. Defined below.
XrayEnabled bool: Whether tracing with X-ray is enabled. Defaults to false.

AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
AdditionalAuthenticationProviders []GraphQLApiAdditionalAuthenticationProvider: One or more additional authentication providers for the GraphqlApi. Defined below.
LogConfig GraphQLApiLogConfig: Nested argument containing logging configuration. Defined below.
Name string: A user-supplied name for the GraphqlApi.
OpenidConnectConfig GraphQLApiOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
Schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
Tags map[string]string: A map of tags to assign to the resource.
UserPoolConfig GraphQLApiUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.
XrayEnabled bool: Whether tracing with X-ray is enabled. Defaults to false.

authenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
additionalAuthenticationProviders GraphQLApiAdditionalAuthenticationProvider[]: One or more additional authentication providers for the GraphqlApi. Defined below.
logConfig GraphQLApiLogConfig: Nested argument containing logging configuration. Defined below.
name string: A user-supplied name for the GraphqlApi.
openidConnectConfig GraphQLApiOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
tags {[key: string]: string}: A map of tags to assign to the resource.
userPoolConfig GraphQLApiUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.
xrayEnabled boolean: Whether tracing with X-ray is enabled. Defaults to false.

authentication_type str: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
additional_authentication_providers List[GraphQLApiAdditionalAuthenticationProvider]: One or more additional authentication providers for the GraphqlApi. Defined below.
log_config Dict[GraphQLApiLogConfig]: Nested argument containing logging configuration. Defined below.
name str: A user-supplied name for the GraphqlApi.
openid_connect_config Dict[GraphQLApiOpenidConnectConfig]: Nested argument containing OpenID Connect configuration. Defined below.
schema str: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
tags Dict[str, str]: A map of tags to assign to the resource.
user_pool_config Dict[GraphQLApiUserPoolConfig]: The Amazon Cognito User Pool configuration. Defined below.
xray_enabled bool: Whether tracing with X-ray is enabled. Defaults to false.

Outputs

All input properties are implicitly available as output properties. Additionally, the GraphQLApi resource produces the following output properties:

Arn string: The ARN
Id string: The provider-assigned unique ID for this managed resource.
Uris Dictionary<string, string>: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql

Arn string: The ARN
Id string: The provider-assigned unique ID for this managed resource.
Uris map[string]string: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql

arn string: The ARN
id string: The provider-assigned unique ID for this managed resource.
uris {[key: string]: string}: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql

arn str: The ARN
id str: The provider-assigned unique ID for this managed resource.
uris Dict[str, str]: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql

Look up an Existing GraphQLApi Resource

Get an existing GraphQLApi resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GraphQLApiState, opts?: CustomResourceOptions): GraphQLApi

static get(resource_name, id, opts=None, additional_authentication_providers=None, arn=None, authentication_type=None, log_config=None, name=None, openid_connect_config=None, schema=None, tags=None, uris=None, user_pool_config=None, xray_enabled=None, __props__=None);

func GetGraphQLApi(ctx *Context, name string, id IDInput, state *GraphQLApiState, opts ...ResourceOption) (*GraphQLApi, error)

public static GraphQLApi Get(string name, Input<string> id, GraphQLApiState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AdditionalAuthenticationProviders List<GraphQLApiAdditionalAuthenticationProviderArgs>: One or more additional authentication providers for the GraphqlApi. Defined below.
Arn string: The ARN
AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
LogConfig GraphQLApiLogConfigArgs: Nested argument containing logging configuration. Defined below.
Name string: A user-supplied name for the GraphqlApi.
OpenidConnectConfig GraphQLApiOpenidConnectConfigArgs: Nested argument containing OpenID Connect configuration. Defined below.
Schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
Tags Dictionary<string, string>: A map of tags to assign to the resource.
Uris Dictionary<string, string>: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql
UserPoolConfig GraphQLApiUserPoolConfigArgs: The Amazon Cognito User Pool configuration. Defined below.
XrayEnabled bool: Whether tracing with X-ray is enabled. Defaults to false.

AdditionalAuthenticationProviders []GraphQLApiAdditionalAuthenticationProvider: One or more additional authentication providers for the GraphqlApi. Defined below.
Arn string: The ARN
AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
LogConfig GraphQLApiLogConfig: Nested argument containing logging configuration. Defined below.
Name string: A user-supplied name for the GraphqlApi.
OpenidConnectConfig GraphQLApiOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
Schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
Tags map[string]string: A map of tags to assign to the resource.
Uris map[string]string: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql
UserPoolConfig GraphQLApiUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.
XrayEnabled bool: Whether tracing with X-ray is enabled. Defaults to false.

additionalAuthenticationProviders GraphQLApiAdditionalAuthenticationProvider[]: One or more additional authentication providers for the GraphqlApi. Defined below.
arn string: The ARN
authenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
logConfig GraphQLApiLogConfig: Nested argument containing logging configuration. Defined below.
name string: A user-supplied name for the GraphqlApi.
openidConnectConfig GraphQLApiOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
schema string: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
tags {[key: string]: string}: A map of tags to assign to the resource.
uris {[key: string]: string}: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql
userPoolConfig GraphQLApiUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.
xrayEnabled boolean: Whether tracing with X-ray is enabled. Defaults to false.

additional_authentication_providers List[GraphQLApiAdditionalAuthenticationProvider]: One or more additional authentication providers for the GraphqlApi. Defined below.
arn str: The ARN
authentication_type str: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
log_config Dict[GraphQLApiLogConfig]: Nested argument containing logging configuration. Defined below.
name str: A user-supplied name for the GraphqlApi.
openid_connect_config Dict[GraphQLApiOpenidConnectConfig]: Nested argument containing OpenID Connect configuration. Defined below.
schema str: The schema definition, in GraphQL schema language format. This provider cannot perform drift detection of this configuration.
tags Dict[str, str]: A map of tags to assign to the resource.
uris Dict[str, str]: Map of URIs associated with the API. e.g. uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql
user_pool_config Dict[GraphQLApiUserPoolConfig]: The Amazon Cognito User Pool configuration. Defined below.
xray_enabled bool: Whether tracing with X-ray is enabled. Defaults to false.

Supporting Types

GraphQLApiAdditionalAuthenticationProvider

See the input and output API doc for this type.

AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
OpenidConnectConfig GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfigArgs: Nested argument containing OpenID Connect configuration. Defined below.
UserPoolConfig GraphQLApiAdditionalAuthenticationProviderUserPoolConfigArgs: The Amazon Cognito User Pool configuration. Defined below.

AuthenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
OpenidConnectConfig GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
UserPoolConfig GraphQLApiAdditionalAuthenticationProviderUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.

authenticationType string: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
openidConnectConfig GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfig: Nested argument containing OpenID Connect configuration. Defined below.
userPoolConfig GraphQLApiAdditionalAuthenticationProviderUserPoolConfig: The Amazon Cognito User Pool configuration. Defined below.

authentication_type str: The authentication type. Valid values: API_KEY, AWS_IAM, AMAZON_COGNITO_USER_POOLS, OPENID_CONNECT
openid_connect_config Dict[GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfig]: Nested argument containing OpenID Connect configuration. Defined below.
user_pool_config Dict[GraphQLApiAdditionalAuthenticationProviderUserPoolConfig]: The Amazon Cognito User Pool configuration. Defined below.

GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfig

See the input and output API doc for this type.

Issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
AuthTtl int: Number of milliseconds a token is valid after being authenticated.
ClientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
IatTtl int: Number of milliseconds a token is valid after being issued to a user.

Issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
AuthTtl int: Number of milliseconds a token is valid after being authenticated.
ClientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
IatTtl int: Number of milliseconds a token is valid after being issued to a user.

issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
authTtl number: Number of milliseconds a token is valid after being authenticated.
clientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
iatTtl number: Number of milliseconds a token is valid after being issued to a user.

issuer str: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
authTtl float: Number of milliseconds a token is valid after being authenticated.
client_id str: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
iatTtl float: Number of milliseconds a token is valid after being issued to a user.

GraphQLApiAdditionalAuthenticationProviderUserPoolConfig

See the input and output API doc for this type.

UserPoolId string: The user pool ID.
AppIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
AwsRegion string: The AWS region in which the user pool was created.

UserPoolId string: The user pool ID.
AppIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
AwsRegion string: The AWS region in which the user pool was created.

userPoolId string: The user pool ID.
appIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
awsRegion string: The AWS region in which the user pool was created.

user_pool_id str: The user pool ID.
appIdClientRegex str: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
awsRegion str: The AWS region in which the user pool was created.

GraphQLApiLogConfig

See the input and output API doc for this type.

CloudwatchLogsRoleArn string: Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
FieldLogLevel string: Field logging level. Valid values: ALL, ERROR, NONE.
ExcludeVerboseContent bool: Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging level. Valid values: true, false. Default value: false

CloudwatchLogsRoleArn string: Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
FieldLogLevel string: Field logging level. Valid values: ALL, ERROR, NONE.
ExcludeVerboseContent bool: Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging level. Valid values: true, false. Default value: false

cloudwatchLogsRoleArn string: Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
fieldLogLevel string: Field logging level. Valid values: ALL, ERROR, NONE.
excludeVerboseContent boolean: Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging level. Valid values: true, false. Default value: false

cloudwatchLogsRoleArn str: Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
fieldLogLevel str: Field logging level. Valid values: ALL, ERROR, NONE.
excludeVerboseContent bool: Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging level. Valid values: true, false. Default value: false

GraphQLApiOpenidConnectConfig

See the input and output API doc for this type.

Issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
AuthTtl int: Number of milliseconds a token is valid after being authenticated.
ClientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
IatTtl int: Number of milliseconds a token is valid after being issued to a user.

Issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
AuthTtl int: Number of milliseconds a token is valid after being authenticated.
ClientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
IatTtl int: Number of milliseconds a token is valid after being issued to a user.

issuer string: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
authTtl number: Number of milliseconds a token is valid after being authenticated.
clientId string: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
iatTtl number: Number of milliseconds a token is valid after being issued to a user.

issuer str: Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
authTtl float: Number of milliseconds a token is valid after being authenticated.
client_id str: Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
iatTtl float: Number of milliseconds a token is valid after being issued to a user.

GraphQLApiUserPoolConfig

See the input and output API doc for this type.

DefaultAction string: The action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn’t match the Amazon Cognito User Pool configuration. Valid: ALLOW and DENY
UserPoolId string: The user pool ID.
AppIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
AwsRegion string: The AWS region in which the user pool was created.

DefaultAction string: The action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn’t match the Amazon Cognito User Pool configuration. Valid: ALLOW and DENY
UserPoolId string: The user pool ID.
AppIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
AwsRegion string: The AWS region in which the user pool was created.

defaultAction string: The action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn’t match the Amazon Cognito User Pool configuration. Valid: ALLOW and DENY
userPoolId string: The user pool ID.
appIdClientRegex string: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
awsRegion string: The AWS region in which the user pool was created.

default_action str: The action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn’t match the Amazon Cognito User Pool configuration. Valid: ALLOW and DENY
user_pool_id str: The user pool ID.
appIdClientRegex str: A regular expression for validating the incoming Amazon Cognito User Pool app client ID.
awsRegion str: The AWS region in which the user pool was created.

Package Details

Repository: https://github.com/pulumi/pulumi-aws
License: Apache-2.0
Notes: This Pulumi package is based on the aws Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

GraphQLApi

Example Usage

API Key Authentication

AWS Cognito User Pool Authentication

AWS IAM Authentication

With Schema

OpenID Connect Authentication

With Multiple Authentication Providers

Enabling Logging

Create a GraphQLApi Resource

GraphQLApi Resource Properties

Inputs

Outputs

Look up an Existing GraphQLApi Resource

Supporting Types

GraphQLApiAdditionalAuthenticationProvider

GraphQLApiAdditionalAuthenticationProviderOpenidConnectConfig

GraphQLApiAdditionalAuthenticationProviderUserPoolConfig

GraphQLApiLogConfig

GraphQLApiOpenidConnectConfig

GraphQLApiUserPoolConfig

Package Details

On This Page