diff --git a/docs/media/api_guide.md b/docs/media/api_guide.md index 17ac9f22036..f22616698ad 100644 --- a/docs/media/api_guide.md +++ b/docs/media/api_guide.md @@ -318,6 +318,23 @@ Amplify.configure({ }); ``` +### Signing a GraphQL request to authenticate with AWS Identity Access Management (IAM). + +Amplify provides the ability to sign requests for IAM authentication. + +Add the following to your configuration statement to enable this for GraphQL requests that are processed through AWS API Gateway: + +```js +Amplify.configure({ + API: { + graphql_endpoint: 'https://www.example.com/my-graphql-endpoint', + graphql_endpoint_iam_region: 'my_graphql_apigateway_region' + } +}); +``` + +Example region value: "us-east-1". + ### Configuration for AWS AppSync AWS AppSync is a cloud-based fully-managed GraphQL service that is integrated with AWS Amplify API category and command line tools with AWS Mobile CLI. diff --git a/packages/aws-amplify/src/API/API.ts b/packages/aws-amplify/src/API/API.ts index 816380d2c2f..55f26d36371 100644 --- a/packages/aws-amplify/src/API/API.ts +++ b/packages/aws-amplify/src/API/API.ts @@ -264,9 +264,9 @@ export default class APIClass { return this._api.endpoint(apiName); } - private async _headerBasedAuth() { + private async _headerBasedAuth(defaultAuthenticationType?) { const { - aws_appsync_authenticationType: authenticationType, + aws_appsync_authenticationType: authenticationType = defaultAuthenticationType, aws_appsync_apiKey: apiKey, } = this._options; let headers = {}; @@ -334,6 +334,7 @@ export default class APIClass { aws_appsync_graphqlEndpoint: appSyncGraphqlEndpoint, graphql_headers = () => ({}), graphql_endpoint: customGraphqlEndpoint, + graphql_endpoint_iam_region: customEndpointRegion } = this._options; const doc = parse(queryStr); @@ -341,7 +342,9 @@ export default class APIClass { const headers = { ...(!customGraphqlEndpoint && await this._headerBasedAuth()), - ...(customGraphqlEndpoint && { Authorization: null }), + ...(customGraphqlEndpoint && + ( customEndpointRegion ? await this._headerBasedAuth('AWS_IAM') : { Authorization: null } ) + ), ... await graphql_headers({ query: doc, variables }) }; @@ -354,8 +357,8 @@ export default class APIClass { headers, body, signerServiceInfo: { - service: 'appsync', - region, + service: !customGraphqlEndpoint ? 'appsync' : 'execute-api', + region: !customGraphqlEndpoint ? region : customEndpointRegion } };