@@ -22,9 +22,52 @@ export enum AuthenticationType {
2222 AMAZON_COGNITO_USER_POOLS = "AMAZON_COGNITO_USER_POOLS" ,
2323 API_KEY = "API_KEY" ,
2424 AWS_IAM = "AWS_IAM" ,
25+ AWS_LAMBDA = "AWS_LAMBDA" ,
2526 OPENID_CONNECT = "OPENID_CONNECT" ,
2627}
2728
29+ /**
30+ * <p>A <code>LambdaAuthorizerConfig</code> holds configuration on how to authorize AppSync API access when using
31+ * the <code>AWS_LAMBDA</code> authorizer mode. Be aware that an AppSync API may have only one Lambda authorizer configured
32+ * at a time.</p>
33+ */
34+ export interface LambdaAuthorizerConfig {
35+ /**
36+ * <p>The number of seconds a response should be cached for. The default is 5 minutes (300 seconds).
37+ * The Lambda function can override this by returning a
38+ * <code>ttlOverride</code> key in its response. A value of 0 disables caching of
39+ * responses.</p>
40+ */
41+ authorizerResultTtlInSeconds ?: number ;
42+
43+ /**
44+ * <p>The ARN of the lambda function to be called for authorization. This may be a standard
45+ * Lambda ARN, a version ARN (<code>.../v3</code>) or alias ARN. </p>
46+ * <p>
47+ * <i>Note</i>: This Lambda function must have the following resource-based
48+ * policy assigned to it. When configuring Lambda authorizers in the Console, this is done for
49+ * you. To do so with the AWS CLI, run the following:</p>
50+ * <p>
51+ * <code>aws lambda add-permission --function-name "arn:aws:lambda:us-east-2:111122223333:function:my-function" --statement-id "appsync" --principal appsync.amazonaws.com --action lambda:InvokeFunction</code>
52+ * </p>
53+ */
54+ authorizerUri : string | undefined ;
55+
56+ /**
57+ * <p>A regular expression for validation of tokens before the Lambda Function is called.</p>
58+ */
59+ identityValidationExpression ?: string ;
60+ }
61+
62+ export namespace LambdaAuthorizerConfig {
63+ /**
64+ * @internal
65+ */
66+ export const filterSensitiveLog = ( obj : LambdaAuthorizerConfig ) : any => ( {
67+ ...obj ,
68+ } ) ;
69+ }
70+
2871/**
2972 * <p>Describes an OpenID Connect configuration.</p>
3073 */
@@ -38,7 +81,7 @@ export interface OpenIDConnectConfig {
3881 /**
3982 * <p>The client identifier of the Relying party at the OpenID identity provider. This
4083 * identifier is typically obtained when the Relying party is registered with the OpenID
41- * identity provider. You can specify a regular expression so the AWS AppSync can validate
84+ * identity provider. You can specify a regular expression so the AppSync can validate
4285 * against multiple client identifiers at a time.</p>
4386 */
4487 clientId ?: string ;
@@ -73,7 +116,7 @@ export interface CognitoUserPoolConfig {
73116 userPoolId : string | undefined ;
74117
75118 /**
76- * <p>The AWS Region in which the user pool was created.</p>
119+ * <p>The Amazon Web Services Region in which the user pool was created.</p>
77120 */
78121 awsRegion : string | undefined ;
79122
@@ -98,7 +141,7 @@ export namespace CognitoUserPoolConfig {
98141 */
99142export interface AdditionalAuthenticationProvider {
100143 /**
101- * <p>The authentication type: API key, AWS IAM , OIDC, or Amazon Cognito user pools.</p>
144+ * <p>The authentication type: API key, Identity and Access Management , OIDC, or Amazon Cognito user pools.</p>
102145 */
103146 authenticationType ?: AuthenticationType | string ;
104147
@@ -111,6 +154,11 @@ export interface AdditionalAuthenticationProvider {
111154 * <p>The Amazon Cognito user pool configuration.</p>
112155 */
113156 userPoolConfig ?: CognitoUserPoolConfig ;
157+
158+ /**
159+ * <p>Configuration for AWS Lambda function authorization.</p>
160+ */
161+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
114162}
115163
116164export namespace AdditionalAuthenticationProvider {
@@ -313,7 +361,7 @@ export namespace ApiCache {
313361
314362/**
315363 * <p>Describes an API key.</p>
316- * <p>Customers invoke AWS AppSync GraphQL API operations with API keys as an identity
364+ * <p>Customers invoke AppSync GraphQL API operations with API keys as an identity
317365 * mechanism. There are two key versions:</p>
318366 * <p>
319367 * <b>da1</b>: This version was introduced at launch in November
@@ -474,16 +522,16 @@ export enum AuthorizationType {
474522}
475523
476524/**
477- * <p>The AWS IAM configuration.</p>
525+ * <p>The Identity and Access Management configuration.</p>
478526 */
479527export interface AwsIamConfig {
480528 /**
481- * <p>The signing region for AWS IAM authorization.</p>
529+ * <p>The signing region for Identity and Access Management authorization.</p>
482530 */
483531 signingRegion ?: string ;
484532
485533 /**
486- * <p>The signing service name for AWS IAM authorization.</p>
534+ * <p>The signing service name for Identity and Access Management authorization.</p>
487535 */
488536 signingServiceName ?: string ;
489537}
@@ -514,7 +562,7 @@ export interface AuthorizationConfig {
514562 authorizationType : AuthorizationType | string | undefined ;
515563
516564 /**
517- * <p>The AWS IAM settings.</p>
565+ * <p>The Identity and Access Management settings.</p>
518566 */
519567 awsIamConfig ?: AwsIamConfig ;
520568}
@@ -717,7 +765,7 @@ export namespace CreateApiCacheResponse {
717765}
718766
719767/**
720- * <p>An internal AWS AppSync error occurred. Try your request again.</p>
768+ * <p>An internal AppSync error occurred. Try your request again.</p>
721769 */
722770export interface InternalFailureException extends __SmithyException , $MetadataBearer {
723771 name : "InternalFailureException" ;
@@ -872,7 +920,7 @@ export interface DynamodbDataSourceConfig {
872920 tableName : string | undefined ;
873921
874922 /**
875- * <p>The AWS Region.</p>
923+ * <p>The Amazon Web Services Region.</p>
876924 */
877925 awsRegion : string | undefined ;
878926
@@ -911,7 +959,7 @@ export interface ElasticsearchDataSourceConfig {
911959 endpoint : string | undefined ;
912960
913961 /**
914- * <p>The AWS Region.</p>
962+ * <p>The Amazon Web Services Region.</p>
915963 */
916964 awsRegion : string | undefined ;
917965}
@@ -931,8 +979,7 @@ export namespace ElasticsearchDataSourceConfig {
931979export interface HttpDataSourceConfig {
932980 /**
933981 * <p>The HTTP URL endpoint. You can either specify the domain name or IP, and port
934- * combination, and the URL scheme must be HTTP or HTTPS. If the port is not specified, AWS
935- * AppSync uses the default port 80 for the HTTP endpoint and port 443 for HTTPS
982+ * combination, and the URL scheme must be HTTP or HTTPS. If the port is not specified, AppSync uses the default port 80 for the HTTP endpoint and port 443 for HTTPS
936983 * endpoints.</p>
937984 */
938985 endpoint ?: string ;
@@ -953,7 +1000,7 @@ export namespace HttpDataSourceConfig {
9531000}
9541001
9551002/**
956- * <p>Describes an AWS Lambda data source configuration.</p>
1003+ * <p>Describes an Amazon Web Services Lambda data source configuration.</p>
9571004 */
9581005export interface LambdaDataSourceConfig {
9591006 /**
@@ -976,7 +1023,7 @@ export namespace LambdaDataSourceConfig {
9761023 */
9771024export interface RdsHttpEndpointConfig {
9781025 /**
979- * <p>AWS Region for RDS HTTP endpoint.</p>
1026+ * <p>Amazon Web Services Region for RDS HTTP endpoint.</p>
9801027 */
9811028 awsRegion ?: string ;
9821029
@@ -996,7 +1043,7 @@ export interface RdsHttpEndpointConfig {
9961043 schema ?: string ;
9971044
9981045 /**
999- * <p>AWS secret store ARN for database credentials.</p>
1046+ * <p>Amazon Web Services secret store ARN for database credentials.</p>
10001047 */
10011048 awsSecretStoreArn ?: string ;
10021049}
@@ -1076,7 +1123,7 @@ export interface CreateDataSourceRequest {
10761123 type : DataSourceType | string | undefined ;
10771124
10781125 /**
1079- * <p>The AWS IAM service role ARN for the data source. The system assumes this role when
1126+ * <p>The Identity and Access Management service role ARN for the data source. The system assumes this role when
10801127 * accessing the data source.</p>
10811128 */
10821129 serviceRoleArn ?: string ;
@@ -1087,7 +1134,7 @@ export interface CreateDataSourceRequest {
10871134 dynamodbConfig ?: DynamodbDataSourceConfig ;
10881135
10891136 /**
1090- * <p>AWS Lambda settings.</p>
1137+ * <p>Amazon Web Services Lambda settings.</p>
10911138 */
10921139 lambdaConfig ?: LambdaDataSourceConfig ;
10931140
@@ -1150,7 +1197,7 @@ export interface DataSource {
11501197 * </li>
11511198 * <li>
11521199 * <p>
1153- * <b>AWS_LAMBDA</b>: The data source is an AWS Lambda
1200+ * <b>AWS_LAMBDA</b>: The data source is an Amazon Web Services Lambda
11541201 * function.</p>
11551202 * </li>
11561203 * <li>
@@ -1175,7 +1222,7 @@ export interface DataSource {
11751222 type ?: DataSourceType | string ;
11761223
11771224 /**
1178- * <p>The AWS IAM service role ARN for the data source. The system assumes this role when
1225+ * <p>The Identity and Access Management service role ARN for the data source. The system assumes this role when
11791226 * accessing the data source.</p>
11801227 */
11811228 serviceRoleArn ?: string ;
@@ -1186,7 +1233,7 @@ export interface DataSource {
11861233 dynamodbConfig ?: DynamodbDataSourceConfig ;
11871234
11881235 /**
1189- * <p>AWS Lambda settings.</p>
1236+ * <p>Amazon Web Services Lambda settings.</p>
11901237 */
11911238 lambdaConfig ?: LambdaDataSourceConfig ;
11921239
@@ -1515,7 +1562,7 @@ export interface LogConfig {
15151562 fieldLogLevel : FieldLogLevel | string | undefined ;
15161563
15171564 /**
1518- * <p>The service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in
1565+ * <p>The service role that AppSync will assume to publish to Amazon CloudWatch logs in
15191566 * your account. </p>
15201567 */
15211568 cloudWatchLogsRoleArn : string | undefined ;
@@ -1551,7 +1598,7 @@ export interface UserPoolConfig {
15511598 userPoolId : string | undefined ;
15521599
15531600 /**
1554- * <p>The AWS Region in which the user pool was created.</p>
1601+ * <p>The Amazon Web Services Region in which the user pool was created.</p>
15551602 */
15561603 awsRegion : string | undefined ;
15571604
@@ -1590,7 +1637,7 @@ export interface CreateGraphqlApiRequest {
15901637 logConfig ?: LogConfig ;
15911638
15921639 /**
1593- * <p>The authentication type: API key, AWS IAM , OIDC, or Amazon Cognito user pools.</p>
1640+ * <p>The authentication type: API key, Identity and Access Management , OIDC, or Amazon Cognito user pools.</p>
15941641 */
15951642 authenticationType : AuthenticationType | string | undefined ;
15961643
@@ -1620,6 +1667,11 @@ export interface CreateGraphqlApiRequest {
16201667 * <code>GraphqlApi</code>.</p>
16211668 */
16221669 xrayEnabled ?: boolean ;
1670+
1671+ /**
1672+ * <p>Configuration for AWS Lambda function authorization.</p>
1673+ */
1674+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
16231675}
16241676
16251677export namespace CreateGraphqlApiRequest {
@@ -1693,10 +1745,16 @@ export interface GraphqlApi {
16931745 xrayEnabled ?: boolean ;
16941746
16951747 /**
1696- * <p>The ARN of the AWS Web Application Firewall ( WAF) ACL associated with this
1748+ * <p>The ARN of the WAF ACL associated with this
16971749 * <code>GraphqlApi</code>, if one exists.</p>
16981750 */
16991751 wafWebAclArn ?: string ;
1752+
1753+ /**
1754+ * <p></p>
1755+ * <p>Configuration for AWS Lambda function authorization.</p>
1756+ */
1757+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
17001758}
17011759
17021760export namespace GraphqlApi {
@@ -3344,7 +3402,7 @@ export interface UpdateDataSourceRequest {
33443402 dynamodbConfig ?: DynamodbDataSourceConfig ;
33453403
33463404 /**
3347- * <p>The new AWS Lambda configuration.</p>
3405+ * <p>The new Amazon Web Services Lambda configuration.</p>
33483406 */
33493407 lambdaConfig ?: LambdaDataSourceConfig ;
33503408
@@ -3509,6 +3567,11 @@ export interface UpdateGraphqlApiRequest {
35093567 * <code>GraphqlApi</code>.</p>
35103568 */
35113569 xrayEnabled ?: boolean ;
3570+
3571+ /**
3572+ * <p>Configuration for AWS Lambda function authorization.</p>
3573+ */
3574+ lambdaAuthorizerConfig ?: LambdaAuthorizerConfig ;
35123575}
35133576
35143577export namespace UpdateGraphqlApiRequest {
0 commit comments