AppSync now has full support for completely custom auth via Lambda authorizers (https://aws.amazon.com/blogs/mobile/appsync-lambda-auth/)