Unable to use count inside a lambda function

[Tedsterh]

Hi, sorry its me again,

So I am able to call searchTraits and listTraits from inside the function but I cannot call countTraits, I am also unable to use the an apiKey to call the count even though my model has the correct auth on it.

I have tried to remove permissions and add them again, but no luck.

[multimeric]

Can you please post the full error message you get from the lambda?

[multimeric]

When I create a lambda using Amplify, it automatically gets given a policy called amplify-lambda-execution-policy which allows it access to all Query endpoints, so I don't see how the countTraits would be excluded from this.

[Tedsterh]

I just get an unauthorised message

{
      path: [Array],
      data: null,
      errorType: 'Unauthorized',
      errorInfo: null,
      locations: [Array],
      message: 'Not Authorized to access countTrait on type Query'
 }

The auth rules for the model

type Trait @model @searchable @count
  @auth(rules: [
    {allow: owner, ownerField: "userID", operations: [read]},
    {allow: private, provider: iam},
    {allow: public, operations: [read], provider: apiKey},
    {allow: groups, groups: ["User"], operations: [read]},
    {allow: groups, groups: ["Admin"]},
  ]) {}

[Tedsterh]

{
    "Fn::Join": [
        "",
        [
            "arn:aws:appsync:",
            {
                "Ref": "AWS::Region"
            },
            ":",
            {
                "Ref": "AWS::AccountId"
            },
            ":apis/",
            {
                "Ref": "apianimalGraphQLAPIIdOutput"
            },
            "/types/Query/*"
        ]
    ]
}

It has all the right permissions in its policy

[multimeric]

Hi, can you please use code blocks with the correct (graphql) syntax highlighting please? https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks

Can you also post the lambda role document, by finding the lambda function in the console, opening "Configuration", then "Permissions", then "View role document"

[Tedsterh]

Sorry just gone back and edited those
Heres the Statements from the role document

"statements": [
        {
            "action": "appsync:GraphQL",
            "effect": "Allow",
            "resource": "arn:aws:appsync:us-east-2:<APP-ID>:apis/<API-ID>/types/Query/*",
            "service": "appsync",
            "source": {
                "index": "0",
                "policyName": "amplify-lambda-execution-policy",
                "policyType": "inline"
            }
        },
        {
            "action": "appsync:GraphQL",
            "effect": "Allow",
            "resource": "arn:aws:appsync:us-east-2:<APP-ID>:apis/<API-ID>/types/Mutation/*",
            "service": "appsync",
            "source": {
                "index": "0",
                "policyName": "amplify-lambda-execution-policy",
                "policyType": "inline"
            }
        }
    ]

[multimeric]

I'm a bit stumped by this, actually. Because this part of the docs suggests that it's the lambda role policy that grants it access to the API, and we can see from what you've posted that it should have access to all Query types.

[multimeric]

Maybe consider asking on one of the Amplify forums and if you find anything I can try to fix it here.

[Tedsterh]

Yes it's very bizarre, I shall open a ticket with them. It's weird because it also doesn't let me me call it with the API key either, only a user pool token

[Tedsterh]

I have the same problem with my queries that have lambda functions attached using the @function

[multimeric]

Oh, if the API key isn't working either than that's a bit less surprising. Can you see if the cognito pool has any policies that might explain why it works properly?

[Tedsterh]

How can I check what permissions a user from a userPool might have? Theres nothing in its CloudFormation about the api

[multimeric]

Try opening the AppSync API in the console and clicking Settings

[Tedsterh]

It looks like it defaults to allow?

[multimeric]

That might relate to it. Can you also show me the AppSync resolver for your working (e.g. listTrait) queries? They should be in your Amplify app: amplify/backend/api/<resource_name>/build/resolvers