AWS appsync high security documentation change
Summary
Updated tutorial to use Aurora Serverless v2, expanded security section with SQL injection prevention guidance, restructured content flow, and added detailed IAM policy configuration
Security assessment
The change adds explicit documentation about SQL injection protection through input sanitization and variableMap usage. The renamed 'Secure Your Data Access' section emphasizes security best practices, and the added 'Protection against SQL injection' bullet in Benefits shows security focus. The IAM policy now explicitly lists required RDS Data API permissions and Secrets Manager access.
Diff
diff --git a/appsync/latest/devguide/tutorial-rds-resolvers.md b/appsync/latest/devguide/tutorial-rds-resolvers.md index cdabc27ed..64aa64385 100644 --- a//appsync/latest/devguide/tutorial-rds-resolvers.md +++ b//appsync/latest/devguide/tutorial-rds-resolvers.md @@ -5 +5 @@ -Create clusterEnable Data APICreate database and tableGraphQL schemaConfiguring ResolversRun mutationsRun QueriesInput Sanitization +Setting up your database clusterEnable Data APICreate database and tableGraphQL schemaConnect Your API to Database OperationsModify Your Data Through the APIRetrieve Your DataSecure Your Data Access @@ -9 +9 @@ Create clusterEnable Data APICreate database and tableGraphQL schemaConfiguring -Using Aurora Serverless with AWS AppSync +Using Aurora Serverless v2 with AWS AppSync @@ -11 +11 @@ Using Aurora Serverless with AWS AppSync -AWS AppSync provides a data source for executing SQL commands against Amazon Aurora Serverless clusters which have been enabled with a Data API. You can use AppSync resolvers to execute SQL statements against the Data API with GraphQL queries, mutations, and subscriptions. +Connect your GraphQL API to Aurora Serverless databases using AWS AppSync. This integration lets you execute SQL statements through GraphQL queries, mutations, and subscriptions - giving you a flexible way to interact with your relational data. @@ -13 +13 @@ AWS AppSync provides a data source for executing SQL commands against Amazon Aur -## Create cluster +###### Note @@ -15 +15 @@ AWS AppSync provides a data source for executing SQL commands against Amazon Aur -Before adding an RDS data source to AppSync you must first enable a Data API on an Aurora Serverless cluster and **configure a secret** using AWS Secrets Manager. You can create an Aurora Serverless cluster first with AWS CLI: +This tutorial uses the `US-EAST-1` Region. @@ -16,0 +17,66 @@ Before adding an RDS data source to AppSync you must first enable a Data API on +###### Benefits + + * Seamless integration between GraphQL and relational databases + + * Ability to perform SQL operations through GraphQL interfaces + + * Serverless scalability with Aurora Serverless v2 + + * Secure data access through AWS Secrets Manager + + * Protection against SQL injection through input sanitization + + * Flexible query capabilities including filtering and range operations + + + + +###### Common Use Cases + + * Building scalable applications with relational data requirements + + * Creating APIs that need both GraphQL flexibility and SQL database capabilities + + * Managing data operations through GraphQL mutations and queries + + * Implementing secure database access patterns + + + + +In this tutorial, you will learn the following. + + * Set up an Aurora Serverless v2 cluster + + * Enable Data API functionality + + * Create and configure database structures + + * Define GraphQL schemas for database operations + + * Implement resolvers for queries and mutations + + * Secure your data access through proper input sanitization + + * Execute various database operations through GraphQL interfaces + + + + +###### Topics + + * Setting up your database cluster + + * Enable Data API + + * Create database and table + + * GraphQL schema + + * Connect Your API to Database Operations + + * Modify Your Data Through the API + + * Retrieve Your Data + + * Secure Your Data Access @@ -18,3 +84,16 @@ Before adding an RDS data source to AppSync you must first enable a Data API on - aws rds create-db-cluster --db-cluster-identifier http-endpoint-test --master-username USERNAME \ - --master-user-password COMPLEX_PASSWORD --engine aurora --engine-mode serverless \ - --region us-east-1 + + + +## Setting up your database cluster + +Before adding an Amazon RDS data source to AWS AppSync, you must first enable a Data API on an Aurora Serverless v2 cluster and **configure a secret** using _AWS Secrets Manager_. You can create an Aurora Serverless v2 cluster using the AWS CLI: + + + aws rds create-db-cluster \ + --db-cluster-identifier appsync-tutorial \ + --engine aurora-mysql \ + --engine-version 8.0 \ + --serverless-v2-scaling-configuration MinCapacity=0,MaxCapacity=1 \ + --master-username USERNAME \ + --master-user-password COMPLEX_PASSWORD \ + --enable-http-endpoint @@ -24 +103,19 @@ This will return an ARN for the cluster. -Create a Secret via the AWS Secrets Manager Console or also via the CLI with an input file such as the following using the USERNAME and COMPLEX_PASSWORD from the previous step: +After creating the cluster, you must add an Aurora Serverless v2 instance using the following command. + + + aws rds create-db-instance \ + --db-cluster-identifier appsync-tutorial \ + --db-instance-identifier appsync-tutorial-instance-1 \ + --db-instance-class db.serverless \ + --engine aurora-mysql + +###### Note + +These endpoints take time to activate. You can check their status in the Amazon RDS console in the **Connectivity & security** tab for the cluster. You can also check the status of your cluster with the following AWS CLI command. + + + aws rds describe-db-clusters \ + --db-cluster-identifier appsync-tutorial \ + --query "DBClusters[0].Status" + +You can create a _Secret_ using the AWS Secrets Manager Console or the AWS CLI with an input file such as the following using the `USERNAME` and `COMPLEX_PASSWORD` from the previous step. @@ -116,0 +214,6 @@ Now that your Aurora Serverless Data API is up and running with a table, we will +JSON + + +**** + + @@ -151 +255,117 @@ Note there are two **Statements** in this policy which you are granting role acc -## Configuring Resolvers +Pass this as a parameter to the AWS CLI. + + + aws secretsmanager create-secret \ + --name HttpRDSSecret \ + --secret-string file://creds.json \ + --region us-east-1 + +This will return an ARN for the secret. Take note of the ARN of your Aurora Serverless cluster and Secret for later when creating a data source in the AWS AppSync console. + +### Build Your Database Structure + +Once you have enabled your Data API you can ensure it works with the `aws rds-data execute-statement` command in the AWS CLI. This will ensure that your Aurora Serverless v2 cluster is configured correctly before adding it to your AWS AppSync API. First, create a database called _TESTDB_ with the `--sql` parameter as follows. + + + aws rds-data execute-statement \ + --resource-arn "arn:aws:rds:us-east-1:111122223333:cluster:appsync-tutorial" \ + --secret-arn "arn:aws:secretsmanager:us-east-1:111122223333:secret:appsync-tutorial-rds-secret" \ + --region us-east-1 \ + --sql "create DATABASE TESTDB" + +If this runs without errors, add a table with the following _create table_ command. + + + aws rds-data execute-statement \ + --resource-arn "arn:aws:rds:us-east-1:111122223333:cluster:http-endpoint-test" \ + --secret-arn "arn:aws:secretsmanager:us-east-1:111122223333:secret:testHttp2-AmNvc1" \ + --region us-east-1 \ + --sql "create table Pets(id varchar(200), type varchar(200), price float)" \ + --database "TESTDB" + +### Design Your API Interface + +After Aurora Serverless v2 Data API is up and running with a table, create a GraphQL schema and attach resolvers for performing mutations and subscriptions. Create a new API in the AWS AppSync console and navigate to the **Schema** page in the console, and enter the following. + + + type Mutation { + createPet(input: CreatePetInput!): Pet + updatePet(input: UpdatePetInput!): Pet + deletePet(input: DeletePetInput!): Pet + } + + input CreatePetInput { + type: PetType + price: Float! + } + + input UpdatePetInput { + id: ID! + type: PetType + price: Float! + } + + input DeletePetInput { + id: ID! + } + + type Pet { + id: ID! + type: PetType + price: Float + } + + enum PetType {