使用 IAM 账户时，AppSync 查询返回 Unauthorized

Question

我正在使用 AWS Amplify。我的 GraphQL 架构中有两个如下模型。

type Class 
  @model 
  @auth(rules: [{ 
    allow: owner, 
    identityClaim: "sub" 
  }      
  {
    allow: owner
    identityClaim: "sub" 
    ownerField: "studentUserIds"
    operations: [read]
  }
  { 
    allow: private, 
    provider: iam 
    operations: [read]
  }
]) {
  id: ID!
  name: String!
  studentUserIds: [String!]
  students: [Student!] @connection(keyName: "ClassStudent", fields: ["id"])
}


type Student
  @model(queries: null)
  @auth(
    rules: [
      { allow: owner, identityClaim: "sub", operations: [create, update, delete, read] }
      { allow: private, provider: iam, operations: [create, update, delete, read] }
      { allow: owner, ownerField: "studentUserId", operations: [update, delete] }
      { allow: private, operations: [read] }
    ]
  )
  @key(name: "ClassStudent", fields: ["classId", "id"]) 
  @key(name: "ClassesByStudent", fields: ["studentUserId"], queryField: "classesByStudent") {
  id: ID!
  classId: ID!
  class: Class @connection(fields: ["classId"])
  studentUserId: ID!
  user: User! @connection(fields: ["studentUserId"])
  owner: String
}

当我使用 IAM 帐户运行 classesByStudent 时，我收到未经授权的响应，即使 IAM 提供程序对 Student 表和 Class 表都有读取权限。我做错了什么？

Answer 1

我添加以下错误：

{"errorType":"Unauthorized","message":"Not Authorized to access onCreateMessage on type Message"}

通过创建 amplify/backend/api//custom-roles.json 文件为我解决了这个问题，如 here 所述