IAMAccessPolicy.json

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "An auto-generated nested stack.",
	"Metadata": {},
	"Parameters": {
		"AppSyncApiId": {
			"Type": "String",
			"Description": "The id of the AppSync API associated with this project."
		},
		"AppSyncApiName": {
			"Type": "String",
			"Description": "The name of the AppSync API",
			"Default": "AppSyncSimpleTransform"
		},
		"env": {
			"Type": "String",
			"Description": "The environment name. e.g. Dev, Test, or Production",
			"Default": "NONE"
		},
		"authRoleName": {
			"Type": "String",
			"Default": "app-authRole"
		}
	},
	"Resources": {
		"appsyncexecutionpolicy": {
			"Type": "AWS::IAM::Policy",
			"Properties": {
				"PolicyName": {
					"Fn::Sub": [
						"appsync-${api}-policy",
						{
							"api": {
								"Ref": "AppSyncApiId"
							}
						}
					]
				},
				"Roles": [
					{
						"Ref": "authRoleName"
					}
				],
				"PolicyDocument": {
					"Version": "2012-10-17",
					"Statement": [
						{
							"Sid": "customerappsync",
							"Effect": "Allow",
							"Action": [
								"appsync:GraphQL"
							],
							"Resource": [
								{
									"Fn::Sub": [
										"arn:aws:appsync:${region}:${account}:apis/${appid}",
										{
											"region": {
												"Ref": "AWS::Region"
											},
											"account": {
												"Ref": "AWS::AccountId"
											},
											"appid": {
												"Ref": "AppSyncApiId"
											}
										}
									]
								},
								{
									"Fn::Sub": [
										"arn:aws:appsync:${region}:${account}:apis/${appid}/*",
										{
											"region": {
												"Ref": "AWS::Region"
											},
											"account": {
												"Ref": "AWS::AccountId"
											},
											"appid": {
												"Ref": "AppSyncApiId"
											}
										}
									]
								},
								{
									"Fn::Sub": [
										"arn:aws:appsync:${region}:${account}:apis/${appid}/types/*",
										{
											"region": {
												"Ref": "AWS::Region"
											},
											"account": {
												"Ref": "AWS::AccountId"
											},
											"appid": {
												"Ref": "AppSyncApiId"
											}
										}
									]
								},
								{
									"Fn::Sub": [
										"arn:aws:appsync:${region}:${account}:apis/${appid}/types/*/fields/*",
										{
											"region": {
												"Ref": "AWS::Region"
											},
											"account": {
												"Ref": "AWS::AccountId"
											},
											"appid": {
												"Ref": "AppSyncApiId"
											}
										}
									]
								}
							]
						}
					]
				}
			}
		}
	},
	"Conditions": {
		"HasEnvironmentParameter": {
			"Fn::Not": [
				{
					"Fn::Equals": [
						{
							"Ref": "env"
						},
						"NONE"
					]
				}
			]
		}
	},
	"Outputs": {
	}
}