Function Auth Role - "Read" Permission does not give "appsync:GraphQL" access in IAM Role.

[blazinaj]

When creating an Amplify CLI Function, I am assuming that choosing the 'read' option will allow us to perform queries. When using this option, "appsync:GraphQL" does not get added to the IAM Role Policy for this Lambda, thus initializing an AppSync Client in the Lambda fails.

Adding 'Create', 'Update', or 'Delete' then adds the necessary "appsync:GraphQL" action to the Lambda role. This may be by design, but took us a bit to figure out. May not be a Bug per se.

[half2me]

I literally ran into this just today. There also doesn't seem to be a way to give only the appsync:GraphQL action to the role, without granting any other privileges. (Without manually editing the cf template)

[attilah]

Duplicate of #4306, #5342 fixes it

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels for those types of questions.