AWS Amplify AppSync查询授权异常：合法用户无法访问自有数据

使用AWS Amplify AppSync查询登录用户应访问的数据时，明明是数据的合法所有者，执行查询却返回「Unauthorized」错误。

错误信息 #

{
  "data": {
    "getXXXXXXUserAccount": null
  },
  "errors": [
    {
      "path": [
        "getXXXXXXUserAccount"
      ],
      "data": null,
      "errorType": "Unauthorized",
      "errorInfo": null,
      "locations": [
        {
          "line": 2,
          "column": 3,
          "sourceName": null
        }
      ],
      "message": "Not Authorized to access getXXXXXXUserAccount on type Query"
    }
  ]
}

GraphQL查询语句 #

query MyQuery {
  getXXXXXXUserAccount(id: "c13cdc53-8a2b-4d05-8ede-5fc66a8ac4e3") {
    id
  }
}

AppSync Schema定义 #

type XXXXXXUserAccount @model @auth(rules: [{ allow: owner, operations: [create, read, update, delete] }]) {
...
}

当前IAM授权策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "appsync:GraphQL",
            "Resource": [
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/XXXXXXXXXXXXXContactForm/*",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Query/fields/getXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Query/fields/listXXXXXXXXXXXXXContactForms",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/createXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/updateXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/deleteXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onCreateXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onUpdateXXXXXXXXXXXXXContactForm",
                "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onDeleteXXXXXXXXXXXXXContactForm"
            ],
            "Effect": "Allow"
        }
    ]
}

排查与解决步骤 #

1. 补充IAM策略中缺失的资源权限
   目前的IAM策略仅包含XXXXXXXXXXXXXContactForm相关权限，完全没有XXXXXXUserAccount对应的资源ARN。需添加该类型的所有操作权限，示例如下：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": "appsync:GraphQL",
               "Resource": [
                   // 保留原有ContactForm权限
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/XXXXXXUserAccount/*",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Query/fields/getXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Query/fields/listXXXXXXUserAccounts",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/createXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/updateXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Mutation/fields/deleteXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onCreateXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onUpdateXXXXXXUserAccount",
                   "arn:aws:appsync:XXXXXXXXXXX:apis/XXXXXXXXXXXXXXXXX/types/Subscription/fields/onDeleteXXXXXXUserAccount"
               ],
               "Effect": "Allow"
           }
       ]
   }
   

2. 确认所有者字段匹配
   @auth的owner规则默认使用owner字段存储用户ID，需确保XXXXXXUserAccount类型中存在该字段，且字段值与当前登录用户ID完全一致。如果自定义了所有者字段（比如userId），需要在规则中明确指定：

   type XXXXXXUserAccount @model @auth(rules: [{ allow: owner, ownerField: "userId", operations: [create, read, update, delete] }]) {
     id: ID!
     userId: String!
     // 其他字段
   }
   

3. 验证请求身份有效性
   可以通过AppSync控制台的Queries页面，选择已登录的用户身份重新执行查询，排查前端凭证传递是否存在问题。

4. 重新部署变更
   修改Schema或IAM策略后，执行amplify push重新部署，确保所有变更生效。

内容的提问来源于stack exchange，提问作者Luke