Custom Authorizer in GraphQL not being invoked

[amcdnl]

How did you install the Amplify CLI?

npm

If applicable, what version of Node.js are you using?

18

Amplify CLI Version

12.8.2

What operating system are you using?

Mac

Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No

Describe the bug

The @custom authorization directive ( https://docs.amplify.aws/react/build-a-backend/graphqlapi/customize-authorization-rules/#custom-authorization-rule and https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#aws-lambda-authorization ) does not seem to work. Its not even getting invoked when I trigger it from AWS Appsync Console even.

Expected behavior

It calls the custom auth lambda.

Reproduction steps

I created the following model:

type Billing
  @model
  @auth(rules: [
    {
      allow: custom
    }
  ]) {
  """
  The unique identifier for the billing.
  """
  id: ID!
}

I can confirm that after running the deploy command it updated my cli-inputs.json:

{
  "version": 1,
  "serviceConfiguration": {
    "apiName": "api",
    "serviceName": "AppSync",
    "defaultAuthType": {
      "mode": "OPENID_CONNECT",
      "openIDProviderName": "asdfasdf",
      "openIDIssuerURL": "https://app-asdfasdfasdf.us.frontegg.com/",
      "openIDClientID": "",
      "openIDAuthTTL": "0",
      "openIDIatTTL": "0"
    },
    "additionalAuthTypes": [
      {
        "mode": "API_KEY",
        "expirationTime": 365,
        "apiKeyExpirationDate": "2024-12-07T13:26:47.653Z",
        "keyDescription": "system"
      },
      {
        "mode": "AWS_LAMBDA",
        "lambdaFunction": "authorizer",
        "ttlSeconds": "0"
      }
    ],
    "conflictResolution": {}
  }
}

As you can see I have a 0 ttl and am using multiple auth providers with OIDC being the default here. When I try to execute this in the console I get an unauthorized error:

as you can see when I go to the logging portion I have 0 logs despite logging being turned on:

Interesting enough if I run the command to get the matrix I get the following:

api git:(main) ✗ amplify status api -acm Billing
🛑 Could not create a role from {"allow":"custom","provider":"function"}

which I haven't been able to find any information on and it does seem to deploy OK ( despite the fact it doens't work at all ). The only changes I've made to the lambda is to make it always return true like:

/**
 * @type {import('@types/aws-lambda').APIGatewayProxyHandler}
 */
exports.handler = async (event) => {
  console.log(`EVENT: ${JSON.stringify(event)}`);

  const {
    authorizationToken,
    requestContext: { apiId, accountId },
  } = event;

  const response = {
    isAuthorized: true, // authorizationToken === 'custom-authorized',
    resolverContext: {
      // eslint-disable-next-line spellcheck/spell-checker
      userid: 'user-id',
      info: 'contextual information A',
      more_info: 'contextual information B',
    },
    deniedFields: [
      // `arn:aws:appsync:${process.env.AWS_REGION}:${accountId}:apis/${apiId}/types/Event/fields/comments`,
      // `Mutation.createEvent`,
    ],
    ttlOverride: 0
  };

  console.log(`response >`, JSON.stringify(response, null, 2));

  return response;
};

I feel like either I'm missing something or this is not compatible with my setup. Maybe someone else who has implemented this can shed some light.

Project Identifier

b22263b845d6e507b22ea849f0297b89

Log output

N/A

Additional information

N/A

Before submitting, please confirm:

• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
• I have removed any sensitive information from my code snippets and submission.

[ykethan]

Hey,👋 thanks for raising this! I'm going to transfer this over to our API repository for better assistance 🙂.

[phani-srikar]

This might be a side-effect and related to #2060. This regression is fixed in #2062 and pending release.

[amcdnl]

@phani-srikar - Awesome news - is there an ETA for release?

[amcdnl]

@phani-srikar - I upgraded to the latest version ( 12.9.0 ) after I saw @dpilch said it was released today however it still doesn't work. I'm get the same messages as above.

[amcdnl]

@dpilch @ykethan @phani-srikar - Is there an ETA on this? Its a major blocker for me at the moment.

[AnilMaktala]

Hey @amcdnl, We recognize the importance of this for you. We're actively working on it and will provide you with an update on the timeline as soon as possible.

[sundersc]

@amcdnl - Are you using a JWT token as authorizer token? In that case, AppSync considers it as Cognito auth mode and process the request incorrectly. Can you add a prefix (say 'Bearer' or something else) and give a try? You can remove this in lambda and extract the actual authorizer token.

Related issues:
aws-amplify/amplify-cli#9836
aws-amplify/amplify-cli#9714