feat: add introspection, query & resolver limits properties in appsync graphql api

samtranslator/internal/model/appsync.py

@@ -115,6 +115,9 @@ class GraphQLApi(Resource):
         "AdditionalAuthenticationProviders": GeneratedProperty(),
         "Visibility": GeneratedProperty(),
         "OwnerContact": GeneratedProperty(),
+        "IntrospectionConfig": GeneratedProperty(),
+        "QueryDepthLimit": GeneratedProperty(),
+        "ResolverCountLimit": GeneratedProperty(),
     }
 
     Name: str
@@ -128,6 +131,9 @@ class GraphQLApi(Resource):
     LogConfig: Optional[LogConfigType]
     Visibility: Optional[str]
     OwnerContact: Optional[str]
+    IntrospectionConfig: Optional[str]
+    QueryDepthLimit: Optional[int]
+    ResolverCountLimit: Optional[int]
 
     runtime_attrs = {"api_id": lambda self: fnGetAtt(self.logical_id, "ApiId")}
 

samtranslator/internal/schema_source/aws_serverless_graphqlapi.py

@@ -164,6 +164,9 @@ class Properties(BaseModel):
     Cache: Optional[Cache]
     Visibility: Optional[PassThroughProp]
     OwnerContact: Optional[PassThroughProp]
+    IntrospectionConfig: Optional[PassThroughProp]
+    QueryDepthLimit: Optional[PassThroughProp]
+    ResolverCountLimit: Optional[PassThroughProp]
 
 
 class Resource(BaseModel):

samtranslator/model/sam_resources.py

@@ -2226,6 +2226,9 @@ class SamGraphQLApi(SamResourceMacro):
         "Cache": Property(False, IS_DICT),
         "Visibility": PassThroughProperty(False),
         "OwnerContact": PassThroughProperty(False),
+        "IntrospectionConfig": PassThroughProperty(False),
+        "QueryDepthLimit": PassThroughProperty(False),
+        "ResolverCountLimit": PassThroughProperty(False),
     }
 
     Auth: List[Dict[str, Any]]
@@ -2243,6 +2246,9 @@ class SamGraphQLApi(SamResourceMacro):
     Cache: Optional[Dict[str, Any]]
     Visibility: Optional[PassThrough]
     OwnerContact: Optional[PassThrough]
+    IntrospectionConfig: Optional[PassThrough]
+    QueryDepthLimit: Optional[PassThrough]
+    ResolverCountLimit: Optional[PassThrough]
 
     # stop validation so we can use class variables for tracking state
     validate_setattr = False
@@ -2322,6 +2328,13 @@ def _construct_appsync_api_resources(
             api.OwnerContact = passthrough_value(model.OwnerContact)
         api.XrayEnabled = model.XrayEnabled
 
+        if model.IntrospectionConfig:
+            api.IntrospectionConfig = passthrough_value(model.IntrospectionConfig)
+        if model.QueryDepthLimit:
+            api.QueryDepthLimit = passthrough_value(model.QueryDepthLimit)
+        if model.ResolverCountLimit:
+            api.ResolverCountLimit = passthrough_value(model.ResolverCountLimit)
+
         lambda_auth_arns = self._parse_and_set_auth_properties(api, model.Auth)
         auth_connectors = [
             self._construct_lambda_auth_connector(api, arn, i) for i, arn in enumerate(lambda_auth_arns, 1)

samtranslator/schema/schema.json

@@ -279735,6 +279735,9 @@
           "title": "Functions",
           "type": "object"
         },
+        "IntrospectionConfig": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
         "Logging": {
           "anyOf": [
             {
@@ -279752,6 +279755,12 @@
         "OwnerContact": {
           "$ref": "#/definitions/PassThroughProp"
         },
+        "QueryDepthLimit": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
+        "ResolverCountLimit": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
         "Resolvers": {
           "additionalProperties": {
             "additionalProperties": {

schema_source/sam.schema.json

@@ -6659,6 +6659,9 @@
           "title": "Functions",
           "type": "object"
         },
+        "IntrospectionConfig": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
         "Logging": {
           "anyOf": [
             {
@@ -6676,6 +6679,12 @@
         "OwnerContact": {
           "$ref": "#/definitions/PassThroughProp"
         },
+        "QueryDepthLimit": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
+        "ResolverCountLimit": {
+          "$ref": "#/definitions/PassThroughProp"
+        },
         "Resolvers": {
           "additionalProperties": {
             "additionalProperties": {

tests/translator/input/graphqlapi_introspection_query_resolver_limits.yaml

@@ -0,0 +1,17 @@
+Transform: AWS::Serverless-2016-10-31
+Resources:
+  SuperCoolAPI:
+    Type: AWS::Serverless::GraphQLApi
+    Properties:
+      SchemaInline: |
+        type Book {
+            bookName: String
+        } 
+        type Query { getBook(bookName: String): Book }
+      Visibility: PRIVATE
+      OwnerContact: blah-blah
+      IntrospectionConfig: DISABLED
+      QueryDepthLimit: 10
+      ResolverCountLimit: 100
+      Auth:
+        Type: AWS_IAM

tests/translator/output/aws-cn/graphqlapi_introspection_query_resolver_limits.json

@@ -0,0 +1,69 @@
+{
+  "Resources": {
+    "SuperCoolAPI": {
+      "Properties": {
+        "AuthenticationType": "AWS_IAM",
+        "IntrospectionConfig": "DISABLED",
+        "LogConfig": {
+          "CloudWatchLogsRoleArn": {
+            "Fn::GetAtt": [
+              "SuperCoolAPICloudWatchRole",
+              "Arn"
+            ]
+          },
+          "FieldLogLevel": "ALL"
+        },
+        "Name": "SuperCoolAPI",
+        "OwnerContact": "blah-blah",
+        "QueryDepthLimit": 10,
+        "ResolverCountLimit": 100,
+        "Tags": [
+          {
+            "Key": "graphqlapi:createdBy",
+            "Value": "SAM"
+          }
+        ],
+        "Visibility": "PRIVATE"
+      },
+      "Type": "AWS::AppSync::GraphQLApi"
+    },
+    "SuperCoolAPICloudWatchRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "appsync.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "SuperCoolAPISchema": {
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "SuperCoolAPI",
+            "ApiId"
+          ]
+        },
+        "Definition": "type Book {\n    bookName: String\n} \ntype Query { getBook(bookName: String): Book }\n"
+      },
+      "Type": "AWS::AppSync::GraphQLSchema"
+    }
+  }
+}

tests/translator/output/aws-us-gov/graphqlapi_introspection_query_resolver_limits.json

@@ -0,0 +1,69 @@
+{
+  "Resources": {
+    "SuperCoolAPI": {
+      "Properties": {
+        "AuthenticationType": "AWS_IAM",
+        "IntrospectionConfig": "DISABLED",
+        "LogConfig": {
+          "CloudWatchLogsRoleArn": {
+            "Fn::GetAtt": [
+              "SuperCoolAPICloudWatchRole",
+              "Arn"
+            ]
+          },
+          "FieldLogLevel": "ALL"
+        },
+        "Name": "SuperCoolAPI",
+        "OwnerContact": "blah-blah",
+        "QueryDepthLimit": 10,
+        "ResolverCountLimit": 100,
+        "Tags": [
+          {
+            "Key": "graphqlapi:createdBy",
+            "Value": "SAM"
+          }
+        ],
+        "Visibility": "PRIVATE"
+      },
+      "Type": "AWS::AppSync::GraphQLApi"
+    },
+    "SuperCoolAPICloudWatchRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "appsync.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "SuperCoolAPISchema": {
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "SuperCoolAPI",
+            "ApiId"
+          ]
+        },
+        "Definition": "type Book {\n    bookName: String\n} \ntype Query { getBook(bookName: String): Book }\n"
+      },
+      "Type": "AWS::AppSync::GraphQLSchema"
+    }
+  }
+}

tests/translator/output/graphqlapi_introspection_query_resolver_limits.json

@@ -0,0 +1,69 @@
+{
+  "Resources": {
+    "SuperCoolAPI": {
+      "Properties": {
+        "AuthenticationType": "AWS_IAM",
+        "IntrospectionConfig": "DISABLED",
+        "LogConfig": {
+          "CloudWatchLogsRoleArn": {
+            "Fn::GetAtt": [
+              "SuperCoolAPICloudWatchRole",
+              "Arn"
+            ]
+          },
+          "FieldLogLevel": "ALL"
+        },
+        "Name": "SuperCoolAPI",
+        "OwnerContact": "blah-blah",
+        "QueryDepthLimit": 10,
+        "ResolverCountLimit": 100,
+        "Tags": [
+          {
+            "Key": "graphqlapi:createdBy",
+            "Value": "SAM"
+          }
+        ],
+        "Visibility": "PRIVATE"
+      },
+      "Type": "AWS::AppSync::GraphQLApi"
+    },
+    "SuperCoolAPICloudWatchRole": {
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "sts:AssumeRole"
+              ],
+              "Effect": "Allow",
+              "Principal": {
+                "Service": [
+                  "appsync.amazonaws.com"
+                ]
+              }
+            }
+          ],
+          "Version": "2012-10-17"
+        },
+        "ManagedPolicyArns": [
+          {
+            "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
+          }
+        ]
+      },
+      "Type": "AWS::IAM::Role"
+    },
+    "SuperCoolAPISchema": {
+      "Properties": {
+        "ApiId": {
+          "Fn::GetAtt": [
+            "SuperCoolAPI",
+            "ApiId"
+          ]
+        },
+        "Definition": "type Book {\n    bookName: String\n} \ntype Query { getBook(bookName: String): Book }\n"
+      },
+      "Type": "AWS::AppSync::GraphQLSchema"
+    }
+  }
+}