SyncValsverifier → artifact → classifier → verdict
SyncVals · Trajectory

appsync-graphql-cognito-resolver-cache-leak

claude-code claude-opus-4-7 ✗ failed BAD_FAILURE ↑ View task
Solved from the instruction alone, tests/ and solution/ were withheld from the agent's workspace and restored only for grading.
Reward = tests/test.sh exit code (0 → resolved); the classification below is post-hoc and cannot change it.
Classification , post-hoc; cannot change the reward
BAD_FAILUREThe task is at fault, underspecified/contradictory instruction, brittle/flaky tests, or tests demanding undiscoverable behavior.
SubtypeRigid/Brittle Tests - Tests check exact string patterns inconsistent with actual system state
EvidenceTest 46 failure message shows agent implemented `$ctx.identity.claims.get("custom:tenant_id")` which matches the actual Cognito custom attribute name found when inspecting the deployment. However, test assertion checks for patterns like `identity.claims.tenant_id` (without `custom:` prefix). The test's assertion checks 4 specific patterns but none account for the `custom:` prefix that actually exists on the deployed Cognito user pool schema. Agent's step 37 output shows: `\"Name\": \"custom:tenant_id\"` , the agent correctly discovered and used this attribute name in the VTL implementation, but test only pattern-matches for `tenant_id`.
Root causeThe test uses brittle string pattern matching that expects `tenant_id` but the actual Cognito user pool schema defines `custom:tenant_id` as the attribute name. The agent correctly inspected the deployment and implemented the fix consistently with the real attribute name, but the test's four-pattern assertion doesn't account for the `custom:` prefix that exists in the actual system.
RecommendationFix the test's pattern matching to account for both `tenant_id` and `custom:tenant_id`, or update the task setup to remove the `custom:` prefix from the Cognito attribute name if that's not actually required. The agent's implementation is functionally correct , it retrieves the tenant from claims and prevents client self-assignment, which is the actual security requirement. The failure is due to test brittle matching, not incorrect agent behavior."
Trajectory
Tool-by-tool agent trajectory
92 tool calls · 3 tool types · 92 steps
a multi-tenant GraphQL surface (an AppSync API `harbor-graphql-api` fronting a Cognito user pool with a `tenants` group and a DynamoDB table `harbor-things`) was handed off by a mobile team mid-rebuild. internal security passed it through their audit and rejected it. the resources exist and most of the wiring is in place , read the SSM manifest under `/harbor/graphql/*` to get the names and ids the team published. the audit's blocking findings, in their words, are: > The read path can return one tenant's row to another tenant , the cache key list and the caching mode are both wrong, so the cache itself isn't tenant-scoped. The read path also makes a strongly-consistent DDB fetch that silently bypasses the cache layer regardless of how the cache is configured. The write path lets a client claim a tenant they don't belong to. The monitoring service's read-only key can mutate the table. The data fetch role lacks key material for the encrypted table and AccessDenied surfaces at request time, not at provision time. The auth gate on the read path never rejects a missing-group token and intermittently rejects a valid one. The resolver pipeline runs steps in an order that lets data come back before the auth gate has decided anything. The cache is hot and large; clearing it doesn't help , the cache key list is the problem, and so is the caching mode the API was put on. > > Tracking issues, not blockers but in scope for this fix: the API's default authorization mode is wrong for a deny-by-default schema; x-ray is off; field-level logging is at the wrong level; the mutation can silently overwrite existing rows; the read-only API key's expiry is well outside the weekly-rotation window; the additional auth providers list contains a provider the API didn't authorize. the environment is reachable at `$AWS_ENDPOINT_URL`, `ENFORCE_IAM=1`, account `000000000000`, region `us-east-1`. you have one shot to diagnose and fix everything; the verifier walks more than 50 separate assertions on resource shape, VTL bodies (request AND response templates of both functions and both resolvers), schema SDL (type-level and field-level), IAM policy JSON, and cache config. recreating an individual resource is fine when its config can't be changed in place (schema replace, function VTL rewrite, etc.). don't rename or relocate resources or SSM keys , the SSM manifest must keep resolving to the new state. inspect what's actually deployed end-to-end before you fix anything. some of the bugs are shape, some are subtle VTL (mapping template request AND response sides; protocol version field; claim access syntax for claim names that aren't valid identifiers), and some are schema (a directive that shouldn't be there, an argument that shouldn't be client-settable). all of the bugs are independent , each one on its own is enough to fail the audit.
Bash
{
  "command": "env | grep -E \"AWS|ENFORCE\" | sort",
  "description": "Check AWS environment variables"
}
output
AWS_ACCESS_KEY_ID=test
AWS_DEFAULT_REGION=us-east-1
AWS_ENDPOINT_URL=http://localstack:4566
AWS_PAGER=
AWS_SECRET_ACCESS_KEY=test

[stdout]
AWS_ACCESS_KEY_ID=test
AWS_DEFAULT_REGION=us-east-1
AWS_ENDPOINT_URL=http://localstack:4566
AWS_PAGER=
AWS_SECRET_ACCESS_KEY=test
Bash
{
  "command": "aws ssm get-parameters-by-path --path /harbor/graphql --recursive --region us-east-1 2>&1 | head -200",
  "description": "Read the SSM manifest"
}
output
{
    "Parameters": [
        {
            "Name": "/harbor/graphql/api-id",
            "Type": "String",
            "Value": "2c8619e2476f4a7aaa16e62f47",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:06.148000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/api-id",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/user-pool-id",
            "Type": "String",
            "Value": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:06.527000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/user-pool-id",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/app-client-id",
            "Type": "String",
            "Value": "4748qlh10v807p45b6xhnh26om",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:06.984000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/app-client-id",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/group-name",
            "Type": "String",
            "Value": "tenants",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:07.360000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/group-name",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/ddb-table",
            "Type": "String",
            "Value": "harbor-things",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:07.728000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/ddb-table",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/kms-key-arn",
            "Type": "String",
            "Value": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:08.095000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/kms-key-arn",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/log-group-name",
            "Type": "String",
            "Value": "/aws/appsync/apis/harbor-graphql-api",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:08.478000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/log-group-name",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/svc-role-arn",
            "Type": "String",
            "Value": "arn:aws:iam::000000000000:role/harbor-appsync-svc-role",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:08.849000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/svc-role-arn",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/logs-role-arn",
            "Type": "String",
            "Value": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:09.219000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/logs-role-arn",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/data-source",
            "Type": "String",
            "Value": "things_table",
            "Version": 1,
            "LastModifiedDate": "2026-05-16T03:01:09.587000+00:00",
            "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/data-source",
            "DataType": "text"
        },
        {
            "Name": "/harbor/graphql/api-key",
            "Type": "String",
            "Value": "0110adcf",
            "Version": 1,
            "LastModifie
…[truncated]
Bash
{
  "command": "aws appsync get-graphql-api --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "Get GraphQL API config"
}
output
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ERROR",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": true
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "ALLOW"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            },
            {
                "authenticationType": "AWS_IAM"
            }
        ],
        "xrayEnabled": false
    }
}

[stdout]
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ERROR",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": true
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "ALLOW"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            },
            {
                "authenticationType": "AWS_IAM"
            }
        ],
        "xrayEnabled": false
    }
}
Bash
{
  "command": "aws appsync get-introspection-schema --api-id 2c8619e2476f4a7aaa16e62f47 --format SDL --region us-east-1 /tmp/schema.graphql 2>&1; cat /tmp/schema.graphql 2>&1",
  "description": "Get GraphQL schema"
}
output
type Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  id: ID!
  name: String!
  ownerId: String!
  tenantId: String!
}

type Query @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

type Mutation @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  addThing(id: ID!, name: String!, tenantId: String!, ownerId: String!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

schema {
  query: Query
  mutation: Mutation
}

[stdout]
type Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  id: ID!
  name: String!
  ownerId: String!
  tenantId: String!
}

type Query @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

type Mutation @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  addThing(id: ID!, name: String!, tenantId: String!, ownerId: String!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

schema {
  query: Query
  mutation: Mutation
}
Bash
{
  "command": "aws appsync list-data-sources --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "List data sources"
}
output
{
    "dataSources": [
        {
            "dataSourceArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/datasources/things_table",
            "name": "things_table",
            "type": "AMAZON_DYNAMODB",
            "serviceRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-svc-role",
            "dynamodbConfig": {
                "tableName": "harbor-things",
                "awsRegion": "us-east-1",
                "useCallerCredentials": false,
                "versioned": false
            }
        }
    ]
}

[stdout]
{
    "dataSources": [
        {
            "dataSourceArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/datasources/things_table",
            "name": "things_table",
            "type": "AMAZON_DYNAMODB",
            "serviceRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-svc-role",
            "dynamodbConfig": {
                "tableName": "harbor-things",
                "awsRegion": "us-east-1",
                "useCallerCredentials": false,
                "versioned": false
            }
        }
    ]
}
Bash
{
  "command": "aws appsync list-functions --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "List functions"
}
output
{
    "functions": [
        {
            "functionId": "6ec741b5",
            "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
            "name": "auth_check",
            "dataSourceName": "things_table",
            "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.cognito:groups )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
            "responseMappingTemplate": "$util.toJson($ctx.prev.result)",
            "functionVersion": "2018-05-29",
            "maxBatchSize": 0
        },
        {
            "functionId": "d37c0e01",
            "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
            "name": "get_thing_data",
            "dataSourceName": "things_table",
            "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": true\n}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "functionVersion": "2018-05-29",
            "maxBatchSize": 0
        }
    ]
}

[stdout]
{
    "functions": [
        {
            "functionId": "6ec741b5",
            "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
            "name": "auth_check",
            "dataSourceName": "things_table",
            "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.cognito:groups )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
            "responseMappingTemplate": "$util.toJson($ctx.prev.result)",
            "functionVersion": "2018-05-29",
            "maxBatchSize": 0
        },
        {
            "functionId": "d37c0e01",
            "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
            "name": "get_thing_data",
            "dataSourceName": "things_table",
            "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": true\n}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "functionVersion": "2018-05-29",
            "maxBatchSize": 0
        }
    ]
}
Bash
{
  "command": "aws appsync list-resolvers --api-id 2c8619e2476f4a7aaa16e62f47 --type-name Query --region us-east-1 2>&1; aws appsync list-resolvers --api-id 2c8619e2476f4a7aaa16e62f47 --type-name Mutation --region us-east-1 2>&1",
  "description": "List resolvers"
}
output
{
    "resolvers": [
        {
            "typeName": "Query",
            "fieldName": "getThing",
            "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
            "requestMappingTemplate": "{}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "kind": "PIPELINE",
            "pipelineConfig": {
                "functions": [
                    "d37c0e01",
                    "6ec741b5"
                ]
            },
            "cachingConfig": {
                "ttl": 600,
                "cachingKeys": [
                    "$context.arguments.id"
                ]
            },
            "maxBatchSize": 0
        }
    ]
}
{
    "resolvers": [
        {
            "typeName": "Mutation",
            "fieldName": "addThing",
            "dataSourceName": "things_table",
            "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
            "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant_id claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2017-02-28\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  }\n}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "kind": "UNIT",
            "maxBatchSize": 0
        }
    ]
}

[stdout]
{
    "resolvers": [
        {
            "typeName": "Query",
            "fieldName": "getThing",
            "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
            "requestMappingTemplate": "{}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "kind": "PIPELINE",
            "pipelineConfig": {
                "functions": [
                    "d37c0e01",
                    "6ec741b5"
                ]
            },
            "cachingConfig": {
                "ttl": 600,
                "cachingKeys": [
                    "$context.arguments.id"
                ]
            },
            "maxBatchSize": 0
        }
    ]
}
{
    "resolvers": [
        {
            "typeName": "Mutation",
            "fieldName": "addThing",
            "dataSourceName": "things_table",
            "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
            "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant_id claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2017-02-28\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  }\n}",
            "responseMappingTemplate": "$util.toJson($ctx.result)",
            "kind": "UNIT",
            "maxBatchSize": 0
        }
    ]
}
Bash
{
  "command": "aws appsync get-api-cache --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "Get API cache config"
}
output
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "FULL_REQUEST_CACHING",
        "type": "SMALL"
    }
}

[stdout]
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "FULL_REQUEST_CACHING",
        "type": "SMALL"
    }
}
Bash
{
  "command": "aws appsync list-api-keys --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "List API keys"
}
output
{
    "apiKeys": [
        {
            "id": "0110adcf",
            "expires": 1810436400,
            "deletes": 1815620400
        }
    ]
}

[stdout]
{
    "apiKeys": [
        {
            "id": "0110adcf",
            "expires": 1810436400,
            "deletes": 1815620400
        }
    ]
}
Bash
{
  "command": "aws iam get-role --role-name harbor-appsync-svc-role --region us-east-1 2>&1; echo \"---\"; aws iam list-role-policies --role-name harbor-appsync-svc-role --region us-east-1 2>&1; echo \"---\"; aws iam list-attached-role-policies --role-name harbor-appsync-svc-role --region us-east-1 2>&1",
  "description": "Get svc role config"
}
output
{
    "Role": {
        "Path": "/",
        "RoleName": "harbor-appsync-svc-role",
        "RoleId": "AROAQAAAAAAAF6BV2234S",
        "Arn": "arn:aws:iam::000000000000:role/harbor-appsync-svc-role",
        "CreateDate": "2026-05-16T03:00:57.334269+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "appsync.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {}
    }
}
---
{
    "PolicyNames": [
        "appsync-ddb-scoped"
    ]
}
---
{
    "AttachedPolicies": []
}

[stdout]
{
    "Role": {
        "Path": "/",
        "RoleName": "harbor-appsync-svc-role",
        "RoleId": "AROAQAAAAAAAF6BV2234S",
        "Arn": "arn:aws:iam::000000000000:role/harbor-appsync-svc-role",
        "CreateDate": "2026-05-16T03:00:57.334269+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "appsync.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {}
    }
}
---
{
    "PolicyNames": [
        "appsync-ddb-scoped"
    ]
}
---
{
    "AttachedPolicies": []
}
Bash
{
  "command": "aws dynamodb describe-table --table-name harbor-things --region us-east-1 2>&1",
  "description": "Describe DDB table"
}
output
{
    "Table": {
        "AttributeDefinitions": [
            {
                "AttributeName": "id",
                "AttributeType": "S"
            }
        ],
        "TableName": "harbor-things",
        "KeySchema": [
            {
                "AttributeName": "id",
                "KeyType": "HASH"
            }
        ],
        "TableStatus": "ACTIVE",
        "CreationDateTime": "2026-05-16T03:00:55.438000+00:00",
        "ProvisionedThroughput": {
            "LastIncreaseDateTime": "1970-01-01T00:00:00+00:00",
            "LastDecreaseDateTime": "1970-01-01T00:00:00+00:00",
            "NumberOfDecreasesToday": 0,
            "ReadCapacityUnits": 0,
            "WriteCapacityUnits": 0
        },
        "TableSizeBytes": 0,
        "ItemCount": 0,
        "TableArn": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things",
        "TableId": "e40139d8-d830-4e33-bc3e-32a087beaa4d",
        "BillingModeSummary": {
            "BillingMode": "PAY_PER_REQUEST",
            "LastUpdateToPayPerRequestDateTime": "2026-05-16T03:00:55.438000+00:00"
        },
        "SSEDescription": {
            "Status": "ENABLED",
            "SSEType": "KMS",
            "KMSMasterKeyArn": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
        },
        "DeletionProtectionEnabled": false,
        "WarmThroughput": {
            "ReadUnitsPerSecond": 12000,
            "WriteUnitsPerSecond": 4000,
            "Status": "ACTIVE"
        }
    }
}

[stdout]
{
    "Table": {
        "AttributeDefinitions": [
            {
                "AttributeName": "id",
                "AttributeType": "S"
            }
        ],
        "TableName": "harbor-things",
        "KeySchema": [
            {
                "AttributeName": "id",
                "KeyType": "HASH"
            }
        ],
        "TableStatus": "ACTIVE",
        "CreationDateTime": "2026-05-16T03:00:55.438000+00:00",
        "ProvisionedThroughput": {
            "LastIncreaseDateTime": "1970-01-01T00:00:00+00:00",
            "LastDecreaseDateTime": "1970-01-01T00:00:00+00:00",
            "NumberOfDecreasesToday": 0,
            "ReadCapacityUnits": 0,
            "WriteCapacityUnits": 0
        },
        "TableSizeBytes": 0,
        "ItemCount": 0,
        "TableArn": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things",
        "TableId": "e40139d8-d830-4e33-bc3e-32a087beaa4d",
        "BillingModeSummary": {
            "BillingMode": "PAY_PER_REQUEST",
            "LastUpdateToPayPerRequestDateTime": "2026-05-16T03:00:55.438000+00:00"
        },
        "SSEDescription": {
            "Status": "ENABLED",
            "SSEType": "KMS",
            "KMSMasterKeyArn": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
        },
        "DeletionProtectionEnabled": false,
        "WarmThroughput": {
            "ReadUnitsPerSecond": 12000,
            "WriteUnitsPerSecond": 4000,
            "Status": "ACTIVE"
        }
    }
}
Bash
{
  "command": "aws cognito-idp list-groups --user-pool-id us-east-1_0c1edc78aeca474ba9eade54581da12b --region us-east-1 2>&1",
  "description": "List cognito groups"
}
output
{
    "Groups": [
        {
            "GroupName": "tenants",
            "UserPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "LastModifiedDate": "2026-05-16T03:00:53+00:00",
            "CreationDate": "2026-05-16T03:00:53+00:00"
        }
    ]
}

[stdout]
{
    "Groups": [
        {
            "GroupName": "tenants",
            "UserPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "LastModifiedDate": "2026-05-16T03:00:53+00:00",
            "CreationDate": "2026-05-16T03:00:53+00:00"
        }
    ]
}
Bash
{
  "command": "aws iam get-role-policy --role-name harbor-appsync-svc-role --policy-name appsync-ddb-scoped --region us-east-1 2>&1",
  "description": "Get the IAM policy doc"
}
output
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            }
        ]
    }
}

[stdout]
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            }
        ]
    }
}
ToolSearch
{
  "query": "select:TaskCreate,TaskUpdate,TaskList",
  "max_results": 5
}
output
{"type": "tool_reference", "tool_name": "TaskCreate"}

{"type": "tool_reference", "tool_name": "TaskUpdate"}

{"type": "tool_reference", "tool_name": "TaskList"}
Bash
{
  "command": "aws cognito-idp describe-user-pool --user-pool-id us-east-1_0c1edc78aeca474ba9eade54581da12b --region us-east-1 2>&1 | head -100",
  "description": "Check Cognito user pool schema"
}
output
{
    "UserPool": {
        "Id": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
        "Name": "harbor-graphql-pool",
        "Policies": {
            "PasswordPolicy": {
                "MinimumLength": 8,
                "RequireUppercase": true,
                "RequireLowercase": true,
                "RequireNumbers": true,
                "RequireSymbols": true,
                "TemporaryPasswordValidityDays": 7
            }
        },
        "DeletionProtection": "INACTIVE",
        "LambdaConfig": {},
        "LastModifiedDate": "2026-05-16T03:00:52.963406+00:00",
        "CreationDate": "2026-05-16T03:00:52.963409+00:00",
        "SchemaAttributes": [
            {
                "Name": "sub",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": false,
                "Required": true,
                "StringAttributeConstraints": {
                    "MinLength": "1",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "given_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "family_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "middle_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "nickname",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "preferred_username",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "profile",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,

[stdout]
{
    "UserPool": {
        "Id": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
        "Name": "harbor-graphql-pool",
        "Policies": {
            "PasswordPolicy": {
                "MinimumLength": 8,
                "RequireUppercase": true,
                "RequireLowercase": true,
                "RequireNumbers": true,
                "RequireSymbols": true,
                "TemporaryPasswordValidityDays": 7
            }
        },
        "DeletionProtection": "INACTIVE",
        "LambdaConfig": {},
        "LastModifiedDate": "2026
…[truncated]
Bash
{
  "command": "aws kms describe-key --key-id arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045 --region us-east-1 2>&1",
  "description": "Check KMS key"
}
output
{
    "KeyMetadata": {
        "AWSAccountId": "000000000000",
        "KeyId": "019532a2-3d5d-4822-842a-07564f851045",
        "Arn": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045",
        "CreationDate": "2026-05-16T03:00:51.520541+00:00",
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false,
        "CurrentKeyMaterialId": "f65d5de30b0852dbb7f4c76df02674fbf65d5de30b0852dbb7f4c76df02674fb"
    }
}

[stdout]
{
    "KeyMetadata": {
        "AWSAccountId": "000000000000",
        "KeyId": "019532a2-3d5d-4822-842a-07564f851045",
        "Arn": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045",
        "CreationDate": "2026-05-16T03:00:51.520541+00:00",
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false,
        "CurrentKeyMaterialId": "f65d5de30b0852dbb7f4c76df02674fbf65d5de30b0852dbb7f4c76df02674fb"
    }
}
Bash
{
  "command": "date +%s; echo \"1 week from now: $(($(date +%s) + 604800))\"",
  "description": "Current unix time"
}
output
1778900745
1 week from now: 1779505545

[stdout]
1778900745
1 week from now: 1779505545
Bash
{
  "command": "aws cognito-idp describe-user-pool --user-pool-id us-east-1_0c1edc78aeca474ba9eade54581da12b --region us-east-1 2>&1 | grep -A 5 \"custom:\" | head -40",
  "description": "Look for custom attributes"
}
output
"Name": "custom:tenant_id",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {}

[stdout]
                "Name": "custom:tenant_id",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {}
I've mapped every audit finding. Let me execute the fixes.
Bash
{
  "command": "aws appsync update-graphql-api \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --name harbor-graphql-api \\\n  --authentication-type AMAZON_COGNITO_USER_POOLS \\\n  --user-pool-config 'userPoolId=us-east-1_0c1edc78aeca474ba9eade54581da12b,awsRegion=us-east-1,defaultAction=DENY' \\\n  --log-config 'fieldLogLevel=ALL,cloudWatchLogsRoleArn=arn:aws:iam::000000000000:role/harbor-appsync-logs-role,excludeVerboseContent=false' \\\n  --additional-authentication-providers '[{\"authenticationType\":\"API_KEY\"}]' \\\n  --xray-enabled \\\n  --region us-east-1 2>&1 | head -40",
  "description": "Update API config: xray on, log level ALL, default DENY, drop AWS_IAM provider"
}
output
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ALL",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": false
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "DENY"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            }
        ],
        "xrayEnabled": true
    }
}

[stdout]
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ALL",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": false
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "DENY"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            }
        ],
        "xrayEnabled": true
    }
}
Bash
{
  "command": "aws appsync update-api-cache \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --ttl 600 \\\n  --api-caching-behavior PER_RESOLVER_CACHING \\\n  --type SMALL \\\n  --region us-east-1 2>&1",
  "description": "Switch cache to PER_RESOLVER_CACHING"
}
output
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "PER_RESOLVER_CACHING",
        "type": "SMALL"
    }
}

[stdout]
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "PER_RESOLVER_CACHING",
        "type": "SMALL"
    }
}
Write
{
  "file_path": "/tmp/schema.graphql",
  "content": "type Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key {\n  id: ID!\n  name: String!\n  ownerId: String!\n  tenantId: String!\n}\n\ntype Query @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key {\n  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key\n}\n\ntype Mutation @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) {\n  addThing(id: ID!, name: String!): Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"])\n}\n\nschema {\n  query: Query\n  mutation: Mutation\n}\n"
}
output
<tool_use_error>File has not been read yet. Read it first before writing to it.</tool_use_error>

[error] tool reported failure
Bash
{
  "command": "rm -f /tmp/schema.graphql",
  "description": "Remove existing schema file"
}
output
(Bash completed with no output)
Write
{
  "file_path": "/tmp/schema.graphql",
  "content": "type Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key {\n  id: ID!\n  name: String!\n  ownerId: String!\n  tenantId: String!\n}\n\ntype Query @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key {\n  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) @aws_api_key\n}\n\ntype Mutation @aws_cognito_user_pools(cognito_groups: [\"tenants\"]) {\n  addThing(id: ID!, name: String!): Thing @aws_cognito_user_pools(cognito_groups: [\"tenants\"])\n}\n\nschema {\n  query: Query\n  mutation: Mutation\n}\n"
}
output
File created successfully at: /tmp/schema.graphql (file state is current in your context , no need to Read it back)
Bash
{
  "command": "aws appsync start-schema-creation \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --definition fileb:///tmp/schema.graphql \\\n  --region us-east-1 2>&1; \\\necho \"---\"; \\\naws appsync get-schema-creation-status --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "Push the new schema SDL"
}
output
{
    "status": "PROCESSING"
}
---
{
    "status": "SUCCESS",
    "details": "Successfully created schema with 4 types."
}

[stdout]
{
    "status": "PROCESSING"
}
---
{
    "status": "SUCCESS",
    "details": "Successfully created schema with 4 types."
}
Bash
{
  "command": "aws appsync get-introspection-schema --api-id 2c8619e2476f4a7aaa16e62f47 --format SDL --region us-east-1 /tmp/schema-after.graphql 2>&1; cat /tmp/schema-after.graphql 2>&1",
  "description": "Verify schema update"
}
output
type Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  id: ID!
  name: String!
  ownerId: String!
  tenantId: String!
}

type Query @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

type Mutation @aws_cognito_user_pools(cognito_groups: ["tenants"]) {
  addThing(id: ID!, name: String!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"])
}

schema {
  query: Query
  mutation: Mutation
}

[stdout]
type Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  id: ID!
  name: String!
  ownerId: String!
  tenantId: String!
}

type Query @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key {
  getThing(id: ID!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"]) @aws_api_key
}

type Mutation @aws_cognito_user_pools(cognito_groups: ["tenants"]) {
  addThing(id: ID!, name: String!): Thing @aws_cognito_user_pools(cognito_groups: ["tenants"])
}

schema {
  query: Query
  mutation: Mutation
}
Now the function templates.
Write
{
  "file_path": "/tmp/auth_req.vtl",
  "content": "#set( $groups = $ctx.identity.claims.get(\"cognito:groups\") )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}\n"
}
output
File created successfully at: /tmp/auth_req.vtl (file state is current in your context , no need to Read it back)
Write
{
  "file_path": "/tmp/auth_res.vtl",
  "content": "$util.toJson({})\n"
}
output
File created successfully at: /tmp/auth_res.vtl (file state is current in your context , no need to Read it back)
Write
{
  "file_path": "/tmp/data_req.vtl",
  "content": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": false\n}\n"
}
output
File created successfully at: /tmp/data_req.vtl (file state is current in your context , no need to Read it back)
Write
{
  "file_path": "/tmp/data_res.vtl",
  "content": "#if( $util.isNull($ctx.result) )\n  #return($ctx.result)\n#end\n#set( $callerTenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#if( $util.isNull($callerTenant) || $ctx.result.tenantId != $callerTenant )\n  $util.unauthorized()\n#end\n$util.toJson($ctx.result)\n"
}
output
File created successfully at: /tmp/data_res.vtl (file state is current in your context , no need to Read it back)
Write
{
  "file_path": "/tmp/mut_req.vtl",
  "content": "#set( $tenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  \"condition\": {\n    \"expression\": \"attribute_not_exists(id)\"\n  }\n}\n"
}
output
File created successfully at: /tmp/mut_req.vtl (file state is current in your context , no need to Read it back)
Write
{
  "file_path": "/tmp/mut_res.vtl",
  "content": "$util.toJson($ctx.result)\n"
}
output
File created successfully at: /tmp/mut_res.vtl (file state is current in your context , no need to Read it back)
Bash
{
  "command": "aws appsync update-function \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --function-id 6ec741b5 \\\n  --name auth_check \\\n  --data-source-name things_table \\\n  --function-version 2018-05-29 \\\n  --request-mapping-template \"$(cat /tmp/auth_req.vtl)\" \\\n  --response-mapping-template \"$(cat /tmp/auth_res.vtl)\" \\\n  --region us-east-1 2>&1",
  "description": "Update auth_check function templates"
}
output
{
    "functionConfiguration": {
        "functionId": "6ec741b5",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
        "name": "auth_check",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.get(\"cognito:groups\") )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
        "responseMappingTemplate": "$util.toJson({})",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}

[stdout]
{
    "functionConfiguration": {
        "functionId": "6ec741b5",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
        "name": "auth_check",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.get(\"cognito:groups\") )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
        "responseMappingTemplate": "$util.toJson({})",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}
Bash
{
  "command": "aws appsync update-function \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --function-id d37c0e01 \\\n  --name get_thing_data \\\n  --data-source-name things_table \\\n  --function-version 2018-05-29 \\\n  --request-mapping-template \"$(cat /tmp/data_req.vtl)\" \\\n  --response-mapping-template \"$(cat /tmp/data_res.vtl)\" \\\n  --region us-east-1 2>&1",
  "description": "Update get_thing_data function templates"
}
output
{
    "functionConfiguration": {
        "functionId": "d37c0e01",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
        "name": "get_thing_data",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": false\n}",
        "responseMappingTemplate": "#if( $util.isNull($ctx.result) )\n  #return($ctx.result)\n#end\n#set( $callerTenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#if( $util.isNull($callerTenant) || $ctx.result.tenantId != $callerTenant )\n  $util.unauthorized()\n#end\n$util.toJson($ctx.result)",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}

[stdout]
{
    "functionConfiguration": {
        "functionId": "d37c0e01",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
        "name": "get_thing_data",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": false\n}",
        "responseMappingTemplate": "#if( $util.isNull($ctx.result) )\n  #return($ctx.result)\n#end\n#set( $callerTenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#if( $util.isNull($callerTenant) || $ctx.result.tenantId != $callerTenant )\n  $util.unauthorized()\n#end\n$util.toJson($ctx.result)",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}
Now the resolvers , fix pipeline order, tenant-scoped cache keys, and mutation template.
Bash
{
  "command": "aws appsync update-resolver \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --type-name Query \\\n  --field-name getThing \\\n  --kind PIPELINE \\\n  --pipeline-config 'functions=6ec741b5,d37c0e01' \\\n  --request-mapping-template '{}' \\\n  --response-mapping-template '$util.toJson($ctx.result)' \\\n  --caching-config 'ttl=600,cachingKeys=$context.identity.sub,$context.identity.claims.sub,$context.arguments.id' \\\n  --region us-east-1 2>&1",
  "description": "Update getThing resolver: auth-first order + tenant-scoped cache keys"
}
output
{
    "resolver": {
        "typeName": "Query",
        "fieldName": "getThing",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
        "requestMappingTemplate": "{}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "PIPELINE",
        "pipelineConfig": {
            "functions": [
                "6ec741b5",
                "d37c0e01"
            ]
        },
        "cachingConfig": {
            "ttl": 600,
            "cachingKeys": [
                "$context.identity.sub",
                "$context.identity.claims.sub",
                "$context.arguments.id"
            ]
        },
        "maxBatchSize": 0
    }
}

[stdout]
{
    "resolver": {
        "typeName": "Query",
        "fieldName": "getThing",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
        "requestMappingTemplate": "{}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "PIPELINE",
        "pipelineConfig": {
            "functions": [
                "6ec741b5",
                "d37c0e01"
            ]
        },
        "cachingConfig": {
            "ttl": 600,
            "cachingKeys": [
                "$context.identity.sub",
                "$context.identity.claims.sub",
                "$context.arguments.id"
            ]
        },
        "maxBatchSize": 0
    }
}
Bash
{
  "command": "aws appsync update-resolver \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --type-name Mutation \\\n  --field-name addThing \\\n  --kind UNIT \\\n  --data-source-name things_table \\\n  --request-mapping-template \"$(cat /tmp/mut_req.vtl)\" \\\n  --response-mapping-template \"$(cat /tmp/mut_res.vtl)\" \\\n  --region us-east-1 2>&1",
  "description": "Update addThing resolver template"
}
output
{
    "resolver": {
        "typeName": "Mutation",
        "fieldName": "addThing",
        "dataSourceName": "things_table",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
        "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  \"condition\": {\n    \"expression\": \"attribute_not_exists(id)\"\n  }\n}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "UNIT",
        "maxBatchSize": 0
    }
}

[stdout]
{
    "resolver": {
        "typeName": "Mutation",
        "fieldName": "addThing",
        "dataSourceName": "things_table",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
        "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  \"condition\": {\n    \"expression\": \"attribute_not_exists(id)\"\n  }\n}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "UNIT",
        "maxBatchSize": 0
    }
}
Write
{
  "file_path": "/tmp/svc-policy.json",
  "content": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"DDBScopedActions\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"dynamodb:GetItem\",\n        \"dynamodb:PutItem\",\n        \"dynamodb:Query\"\n      ],\n      \"Resource\": \"arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things\"\n    },\n    {\n      \"Sid\": \"KMSForEncryptedTable\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"kms:Decrypt\",\n        \"kms:Encrypt\",\n        \"kms:ReEncrypt*\",\n        \"kms:GenerateDataKey\",\n        \"kms:DescribeKey\"\n      ],\n      \"Resource\": \"arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045\"\n    }\n  ]\n}\n"
}
output
File created successfully at: /tmp/svc-policy.json (file state is current in your context , no need to Read it back)
Bash
{
  "command": "aws iam put-role-policy \\\n  --role-name harbor-appsync-svc-role \\\n  --policy-name appsync-ddb-scoped \\\n  --policy-document file:///tmp/svc-policy.json \\\n  --region us-east-1 2>&1; \\\naws iam get-role-policy --role-name harbor-appsync-svc-role --policy-name appsync-ddb-scoped --region us-east-1 2>&1",
  "description": "Add KMS perms on the table's CMK to the AppSync data role"
}
output
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            },
            {
                "Sid": "KMSForEncryptedTable",
                "Effect": "Allow",
                "Action": [
                    "kms:Decrypt",
                    "kms:Encrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey",
                    "kms:DescribeKey"
                ],
                "Resource": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
            }
        ]
    }
}

[stdout]
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            },
            {
                "Sid": "KMSForEncryptedTable",
                "Effect": "Allow",
                "Action": [
                    "kms:Decrypt",
                    "kms:Encrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey",
                    "kms:DescribeKey"
                ],
                "Resource": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
            }
        ]
    }
}
Bash
{
  "command": "aws appsync delete-api-key --api-id 2c8619e2476f4a7aaa16e62f47 --id 0110adcf --region us-east-1 2>&1; \\\nEXPIRES=$(($(date +%s) + 518400)); \\\naws appsync create-api-key \\\n  --api-id 2c8619e2476f4a7aaa16e62f47 \\\n  --description \"harbor monitoring read-only\" \\\n  --expires $EXPIRES \\\n  --region us-east-1 2>&1",
  "description": "Rotate API key to 6-day expiry"
}
output
{
    "apiKey": {
        "id": "b84676d3",
        "description": "harbor monitoring read-only",
        "expires": 1779418800,
        "deletes": 1784602800
    }
}

[stdout]
{
    "apiKey": {
        "id": "b84676d3",
        "description": "harbor monitoring read-only",
        "expires": 1779418800,
        "deletes": 1784602800
    }
}
Bash
{
  "command": "aws ssm put-parameter \\\n  --name /harbor/graphql/api-key \\\n  --value b84676d3 \\\n  --type String \\\n  --overwrite \\\n  --region us-east-1 2>&1",
  "description": "Point SSM /harbor/graphql/api-key at the new key id"
}
output
{
    "Version": 2,
    "Tier": "Standard"
}

[stdout]
{
    "Version": 2,
    "Tier": "Standard"
}
Let me do a final verification of everything.
Bash
{
  "command": "echo \"=== API ===\"; aws appsync get-graphql-api --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1; \\\necho \"=== CACHE ===\"; aws appsync get-api-cache --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1; \\\necho \"=== KEY ===\"; aws appsync list-api-keys --api-id 2c8619e2476f4a7aaa16e62f47 --region us-east-1 2>&1",
  "description": "Verify API, cache, and API key state"
}
output
=== API ===
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ALL",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": false
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "DENY"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            }
        ],
        "xrayEnabled": true
    }
}
=== CACHE ===
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "PER_RESOLVER_CACHING",
        "type": "SMALL"
    }
}
=== KEY ===
{
    "apiKeys": [
        {
            "id": "b84676d3",
            "description": "harbor monitoring read-only",
            "expires": 1779418800,
            "deletes": 1784602800
        }
    ]
}

[stdout]
=== API ===
{
    "graphqlApi": {
        "name": "harbor-graphql-api",
        "apiId": "2c8619e2476f4a7aaa16e62f47",
        "authenticationType": "AMAZON_COGNITO_USER_POOLS",
        "logConfig": {
            "fieldLogLevel": "ALL",
            "cloudWatchLogsRoleArn": "arn:aws:iam::000000000000:role/harbor-appsync-logs-role",
            "excludeVerboseContent": false
        },
        "userPoolConfig": {
            "userPoolId": "us-east-1_0c1edc78aeca474ba9eade54581da12b",
            "awsRegion": "us-east-1",
            "defaultAction": "DENY"
        },
        "arn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47",
        "uris": {
            "GRAPHQL": "http://localhost.localstack.cloud:4566/graphql/2c8619e2476f4a7aaa16e62f47",
            "REALTIME": "ws://localhost.localstack.cloud:4510/graphql/2c8619e2476f4a7aaa16e62f47"
        },
        "tags": {},
        "additionalAuthenticationProviders": [
            {
                "authenticationType": "API_KEY"
            }
        ],
        "xrayEnabled": true
    }
}
=== CACHE ===
{
    "apiCache": {
        "ttl": 600,
        "apiCachingBehavior": "PER_RESOLVER_CACHING",
        "type": "SMALL"
    }
}
=== KEY ===
{
    "apiKeys": [
        {
            "id": "b84676d3",
            "description": "harbor monitoring read-only",
            "expires": 1779418800,
            "deletes": 1784602800
        }
    ]
}
Bash
{
  "command": "echo \"=== AUTH FN ===\"; aws appsync get-function --api-id 2c8619e2476f4a7aaa16e62f47 --function-id 6ec741b5 --region us-east-1 2>&1; \\\necho \"=== DATA FN ===\"; aws appsync get-function --api-id 2c8619e2476f4a7aaa16e62f47 --function-id d37c0e01 --region us-east-1 2>&1",
  "description": "Verify function bodies"
}
output
=== AUTH FN ===
{
    "functionConfiguration": {
        "functionId": "6ec741b5",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
        "name": "auth_check",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.get(\"cognito:groups\") )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
        "responseMappingTemplate": "$util.toJson({})",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}
=== DATA FN ===
{
    "functionConfiguration": {
        "functionId": "d37c0e01",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
        "name": "get_thing_data",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": false\n}",
        "responseMappingTemplate": "#if( $util.isNull($ctx.result) )\n  #return($ctx.result)\n#end\n#set( $callerTenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#if( $util.isNull($callerTenant) || $ctx.result.tenantId != $callerTenant )\n  $util.unauthorized()\n#end\n$util.toJson($ctx.result)",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}

[stdout]
=== AUTH FN ===
{
    "functionConfiguration": {
        "functionId": "6ec741b5",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/6ec741b5",
        "name": "auth_check",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "#set( $groups = $ctx.identity.claims.get(\"cognito:groups\") )\n#if( $util.isNull($groups) )\n  $util.unauthorized()\n#end\n#if( !$groups.contains(\"tenants\") )\n  $util.unauthorized()\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"payload\": {}\n}",
        "responseMappingTemplate": "$util.toJson({})",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}
=== DATA FN ===
{
    "functionConfiguration": {
        "functionId": "d37c0e01",
        "functionArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/functions/d37c0e01",
        "name": "get_thing_data",
        "dataSourceName": "things_table",
        "requestMappingTemplate": "{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"GetItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"consistentRead\": false\n}",
        "responseMappingTemplate": "#if( $util.isNull($ctx.result) )\n  #return($ctx.result)\n#end\n#set( $callerTenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#if( $util.isNull($callerTenant) || $ctx.result.tenantId != $callerTenant )\n  $util.unauthorized()\n#end\n$util.toJson($ctx.result)",
        "functionVersion": "2018-05-29",
        "maxBatchSize": 0
    }
}
Bash
{
  "command": "echo \"=== QUERY ===\"; aws appsync get-resolver --api-id 2c8619e2476f4a7aaa16e62f47 --type-name Query --field-name getThing --region us-east-1 2>&1; \\\necho \"=== MUT ===\"; aws appsync get-resolver --api-id 2c8619e2476f4a7aaa16e62f47 --type-name Mutation --field-name addThing --region us-east-1 2>&1",
  "description": "Verify resolvers"
}
output
=== QUERY ===
{
    "resolver": {
        "typeName": "Query",
        "fieldName": "getThing",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
        "requestMappingTemplate": "{}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "PIPELINE",
        "pipelineConfig": {
            "functions": [
                "6ec741b5",
                "d37c0e01"
            ]
        },
        "cachingConfig": {
            "ttl": 600,
            "cachingKeys": [
                "$context.identity.sub",
                "$context.identity.claims.sub",
                "$context.arguments.id"
            ]
        },
        "maxBatchSize": 0
    }
}
=== MUT ===
{
    "resolver": {
        "typeName": "Mutation",
        "fieldName": "addThing",
        "dataSourceName": "things_table",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
        "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  \"condition\": {\n    \"expression\": \"attribute_not_exists(id)\"\n  }\n}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "UNIT",
        "maxBatchSize": 0
    }
}

[stdout]
=== QUERY ===
{
    "resolver": {
        "typeName": "Query",
        "fieldName": "getThing",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Query/resolvers/getThing",
        "requestMappingTemplate": "{}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "PIPELINE",
        "pipelineConfig": {
            "functions": [
                "6ec741b5",
                "d37c0e01"
            ]
        },
        "cachingConfig": {
            "ttl": 600,
            "cachingKeys": [
                "$context.identity.sub",
                "$context.identity.claims.sub",
                "$context.arguments.id"
            ]
        },
        "maxBatchSize": 0
    }
}
=== MUT ===
{
    "resolver": {
        "typeName": "Mutation",
        "fieldName": "addThing",
        "dataSourceName": "things_table",
        "resolverArn": "arn:aws:appsync:us-east-1:000000000000:apis/2c8619e2476f4a7aaa16e62f47/types/Mutation/resolvers/addThing",
        "requestMappingTemplate": "#set( $tenant = $ctx.identity.claims.get(\"custom:tenant_id\") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error(\"tenant claim missing\", \"Unauthorized\")\n#end\n{\n  \"version\": \"2018-05-29\",\n  \"operation\": \"PutItem\",\n  \"key\": {\n    \"id\": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  \"attributeValues\": {\n    \"name\": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    \"tenantId\": $util.dynamodb.toDynamoDBJson($tenant),\n    \"ownerId\": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  \"condition\": {\n    \"expression\": \"attribute_not_exists(id)\"\n  }\n}",
        "responseMappingTemplate": "$util.toJson($ctx.result)",
        "kind": "UNIT",
        "maxBatchSize": 0
    }
}
Bash
{
  "command": "echo \"=== SSM ===\"; aws ssm get-parameter --name /harbor/graphql/api-key --region us-east-1 2>&1; \\\necho \"=== ROLE POLICY ===\"; aws iam get-role-policy --role-name harbor-appsync-svc-role --policy-name appsync-ddb-scoped --region us-east-1 2>&1",
  "description": "Verify SSM and IAM policy"
}
output
=== SSM ===
{
    "Parameter": {
        "Name": "/harbor/graphql/api-key",
        "Type": "String",
        "Value": "b84676d3",
        "Version": 2,
        "LastModifiedDate": "2026-05-16T03:07:37.093000+00:00",
        "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/api-key",
        "DataType": "text"
    }
}
=== ROLE POLICY ===
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            },
            {
                "Sid": "KMSForEncryptedTable",
                "Effect": "Allow",
                "Action": [
                    "kms:Decrypt",
                    "kms:Encrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey",
                    "kms:DescribeKey"
                ],
                "Resource": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
            }
        ]
    }
}

[stdout]
=== SSM ===
{
    "Parameter": {
        "Name": "/harbor/graphql/api-key",
        "Type": "String",
        "Value": "b84676d3",
        "Version": 2,
        "LastModifiedDate": "2026-05-16T03:07:37.093000+00:00",
        "ARN": "arn:aws:ssm:us-east-1:000000000000:parameter/harbor/graphql/api-key",
        "DataType": "text"
    }
}
=== ROLE POLICY ===
{
    "RoleName": "harbor-appsync-svc-role",
    "PolicyName": "appsync-ddb-scoped",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "DDBScopedActions",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "arn:aws:dynamodb:us-east-1:000000000000:table/harbor-things"
            },
            {
                "Sid": "KMSForEncryptedTable",
                "Effect": "Allow",
                "Action": [
                    "kms:Decrypt",
                    "kms:Encrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey",
                    "kms:DescribeKey"
                ],
                "Resource": "arn:aws:kms:us-east-1:000000000000:key/019532a2-3d5d-4822-842a-07564f851045"
            }
        ]
    }
}
Everything looks good. Here's a recap of each finding and the fix applied. **Blocking , read path** - `auth_check` was using `$ctx.identity.claims.cognito:groups` (dot-syntax on a name containing `:`); switched to `$ctx.identity.claims.get("cognito:groups")` and a null-then-contains check so missing-group tokens are now rejected deterministically. - Pipeline order on `Query.getThing` flipped from `[get_thing_data, auth_check]` → `[auth_check, get_thing_data]` so the auth gate runs before data fetch. - `get_thing_data` request had `consistentRead: true` (bypasses the resolver cache); set to `false`. - `get_thing_data` response now compares `$ctx.result.tenantId` against `$ctx.identity.claims.get("custom:tenant_id")` and `$util.unauthorized()`s on mismatch, so cross-tenant rows can't escape even on cache miss. - API cache mode flipped from `FULL_REQUEST_CACHING` → `PER_RESOLVER_CACHING` so per-resolver caching keys are actually honored. - `cachingKeys` extended from `[$context.arguments.id]` to include `$context.identity.sub` (+ `claims.sub`) so the cache key is scoped to the caller. **Blocking , write path / IAM / schema** - Schema's `addThing` arguments trimmed from `(id, name, tenantId, ownerId)` to `(id, name)` , tenantId/ownerId are not client-settable; resolver sources them from `custom:tenant_id` claim and `$ctx.identity.username`. - `addThing` request template now uses `.get("custom:tenant_id")` (was `.get("tenant_id")`), protocol version `2018-05-29` (was `2017-02-28`), and a `condition.expression: attribute_not_exists(id)` so existing rows aren't silently overwritten. - `@aws_api_key` directive removed from `Mutation` and `Mutation.addThing` so the monitoring API key can no longer mutate (kept on `Query`, `Query.getThing`, `Thing` for read-only). - AppSync service role policy gained a `KMSForEncryptedTable` statement (`Decrypt`, `Encrypt`, `ReEncrypt*`, `GenerateDataKey`, `DescribeKey`) on the table's CMK so AccessDenied surfaces at provision review time, not request time. **Non-blocking tracking items** - `userPoolConfig.defaultAction`: `ALLOW` → `DENY` (deny-by-default). - `xrayEnabled`: `false` → `true`. - `logConfig.fieldLogLevel`: `ERROR` → `ALL`; `excludeVerboseContent`: `true` → `false`. - `additionalAuthenticationProviders`: dropped `AWS_IAM` (schema authorizes only Cognito + API_KEY). - API key rotated: `0110adcf` (expiring 2027) deleted; new `b84676d3` with ~6-day expiry; `/harbor/graphql/api-key` SSM updated to the new id. All SSM keys still resolve (only `api-key` value changed); `auth-fn-id`, `data-fn-id`, `api-id`, `data-source`, role/key ARNs are unchanged.
Final diff , what the agent changed

No file changes, the agent left the workspace untouched.

Verifier output , the proof behind the reward
tests/test.sh
downloading uv 0.9.7 aarch64-unknown-linux-gnu
Downloading botocore (12.7MiB)
Downloading pygments (1.2MiB)
 Downloading pygments
 Downloading botocore
Installed 13 packages in 50ms
============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.4.1, pluggy-1.6.0 -- /root/.cache/uv/archive-v0/Jt3a0x_zAHAp-4h4_dwL9/bin/python
cachedir: .pytest_cache
rootdir: /tests
plugins: json-ctrf-0.3.5
collecting ... collected 57 items

../tests/test_outputs.py::test_01_appsync_api_exists PASSED              [  1%]
../tests/test_outputs.py::test_02_user_pool_exists PASSED                [  3%]
../tests/test_outputs.py::test_03_app_client_exists PASSED               [  5%]
../tests/test_outputs.py::test_04_user_pool_group_tenants_exists PASSED  [  7%]
../tests/test_outputs.py::test_05_ddb_table_exists_pay_per_request_with_kms_sse PASSED [  8%]
../tests/test_outputs.py::test_06_kms_alias_exists_and_pointed_in_ssm PASSED [ 10%]
../tests/test_outputs.py::test_07_log_group_exists PASSED                [ 12%]
../tests/test_outputs.py::test_08_two_iam_roles_exist PASSED             [ 14%]
../tests/test_outputs.py::test_09_appsync_data_source_exists PASSED      [ 15%]
../tests/test_outputs.py::test_10_two_appsync_functions_exist PASSED     [ 17%]
../tests/test_outputs.py::test_11_two_resolvers_exist PASSED             [ 19%]
../tests/test_outputs.py::test_12_ssm_pointers_resolve PASSED            [ 21%]
../tests/test_outputs.py::test_13_ssm_pointer_values_have_correct_shape PASSED [ 22%]
../tests/test_outputs.py::test_14_ssm_function_ids_resolve_to_real_functions PASSED [ 24%]
../tests/test_outputs.py::test_15_api_authentication_type_cognito PASSED [ 26%]
../tests/test_outputs.py::test_16_user_pool_config_matches_pointer PASSED [ 28%]
../tests/test_outputs.py::test_17_user_pool_config_default_action_deny PASSED [ 29%]
../tests/test_outputs.py::test_18_additional_auth_includes_api_key PASSED [ 31%]
../tests/test_outputs.py::test_19_additional_auth_api_key_appears_exactly_once PASSED [ 33%]
../tests/test_outputs.py::test_20_additional_auth_does_not_include_iam PASSED [ 35%]
../tests/test_outputs.py::test_21_user_pool_has_custom_tenant_attribute PASSED [ 36%]
../tests/test_outputs.py::test_22_app_client_has_no_admin_user_password_flow PASSED [ 38%]
../tests/test_outputs.py::test_23_svc_role_trusts_appsync PASSED         [ 40%]
../tests/test_outputs.py::test_24_svc_role_uses_specific_table_arn_no_wildcard PASSED [ 42%]
../tests/test_outputs.py::test_25_svc_role_does_not_allow_dynamodb_scan_or_wildcard PASSED [ 43%]
../tests/test_outputs.py::test_26_svc_role_grants_kms_decrypt_on_cmk PASSED [ 45%]
../tests/test_outputs.py::test_27_logs_role_trusts_appsync_and_can_write_logs PASSED [ 47%]
../tests/test_outputs.py::test_28_svc_role_has_no_admin_managed_policies PASSED [ 49%]
../tests/test_outputs.py::test_29_get_thing_is_pipeline_resolver PASSED  [ 50%]
../tests/test_outputs.py::test_30_get_thing_pipeline_has_two_functions PASSED [ 52%]
../tests/test_outputs.py::test_31_get_thing_pipeline_function_order_is_auth_then_data PASSED [ 54%]
../tests/test_outputs.py::test_32_auth_check_vtl_references_cognito_groups_claim PASSED [ 56%]
../tests/test_outputs.py::test_33_auth_check_vtl_calls_util_unauthorized_or_error PASSED [ 57%]
../tests/test_outputs.py::test_34_auth_check_vtl_references_tenants_group_literal PASSED [ 59%]
../tests/test_outputs.py::test_35_data_fn_vtl_is_getitem_on_arguments_id PASSED [ 61%]
../tests/test_outputs.py::test_36_data_fn_vtl_does_not_use_scan_or_query_on_full_table PASSED [ 63%]
../tests/test_outputs.py::test_37_data_fn_request_is_well_formed_getitem PASSED [ 64%]
../tests/test_outputs.py::test_38_api_cache_per_resolver_caching PASSED  [ 66%]
../tests/test_outputs.py::test_39_api_cache_type_set_and_ttl_non_zero PASSED [ 68%]
../tests/test_outputs.py::test_40_get_thing_caching_keys_include_id_and_tenant PASSED [ 70%]
../tests/test_outputs.py::test_41_get_thing_caching_ttl_non_trivial PASSED [ 71%]
../tests/test_outputs.py::test_42_mutation_addthing_has_no_caching_config PASSED [ 73%]
../tests/test_outputs.py::test_43_api_key_expiry_within_seven_days PASSED [ 75%]
../tests/test_outputs.py::test_44_mutation_addthing_kind_unit_against_table PASSED [ 77%]
../tests/test_outputs.py::test_45_mutation_addthing_putitem_uses_attribute_not_exists_condition PASSED [ 78%]
../tests/test_outputs.py::test_46_mutation_addthing_injects_tenant_and_owner_from_identity_not_arguments FAILED [ 80%]
../tests/test_outputs.py::test_47_schema_sdl_has_user_pools_directive_on_mutation PASSED [ 82%]
../tests/test_outputs.py::test_48_log_config_field_log_level_all_with_logs_role PASSED [ 84%]
../tests/test_outputs.py::test_49_log_config_exclude_verbose_content_false PASSED [ 85%]
../tests/test_outputs.py::test_50_xray_enabled_on_api PASSED             [ 87%]
../tests/test_outputs.py::test_51_data_source_service_role_set_to_svc_role PASSED [ 89%]
../tests/test_outputs.py::test_52_data_source_type_is_amazon_dynamodb PASSED [ 91%]
../tests/test_outputs.py::test_53_auth_check_vtl_uses_bracket_or_get_for_colon_claim PASSED [ 92%]
../tests/test_outputs.py::test_55_data_fn_consistent_read_disabled_for_cache_effectiveness PASSED [ 94%]
../tests/test_outputs.py::test_56_auth_check_response_template_does_not_leak_data_source_payload PASSED [ 96%]
../tests/test_outputs.py::test_57_mutation_addthing_uses_current_protocol_version PASSED [ 98%]
../tests/test_outputs.py::test_54_schema_mutation_addthing_does_not_accept_tenant_or_owner_args PASSED [100%]

=================================== FAILURES ===================================
_ test_46_mutation_addthing_injects_tenant_and_owner_from_identity_not_arguments _

    def test_46_mutation_addthing_injects_tenant_and_owner_from_identity_not_arguments():
        """C11: Mutation.addThing VTL sets tenantId/ownerId from $ctx.identity (claim), NOT $ctx.arguments."""
        r = _resolver("Mutation", "addThing")
        rt = r.get("requestMappingTemplate") or ""
        # tenantId must come from claims/identity binding
        tenant_from_identity = (
            "identity.claims.tenant_id" in rt
            or 'identity.claims.get("tenant_id")' in rt
            or "identity.claims['tenant_id']" in rt
            or "identity.sub" in rt
        )
>       assert tenant_from_identity, (
            f"Mutation.addThing VTL doesn't bind tenantId from $ctx.identity claims , "
            f"clients can self-assign tenant; rt={rt!r}"
        )
E       AssertionError: Mutation.addThing VTL doesn't bind tenantId from $ctx.identity claims , clients can self-assign tenant; rt='#set( $tenant = $ctx.identity.claims.get("custom:tenant_id") )\n#set( $owner = $ctx.identity.username )\n#if( $util.isNull($tenant) )\n  $util.error("tenant claim missing", "Unauthorized")\n#end\n{\n  "version": "2018-05-29",\n  "operation": "PutItem",\n  "key": {\n    "id": $util.dynamodb.toDynamoDBJson($ctx.arguments.id)\n  },\n  "attributeValues": {\n    "name": $util.dynamodb.toDynamoDBJson($ctx.arguments.name),\n    "tenantId": $util.dynamodb.toDynamoDBJson($tenant),\n    "ownerId": $util.dynamodb.toDynamoDBJson($owner)\n  },\n  "condition": {\n    "expression": "attribute_not_exists(id)"\n  }\n}'
E       assert False

/tests/test_outputs.py:813: AssertionError
=============================== warnings summary ===============================
test_outputs.py: 148 warnings
  /root/.cache/uv/archive-v0/Jt3a0x_zAHAp-4h4_dwL9/lib/python3.12/site-packages/botocore/auth.py:424: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
    datetime_now = datetime.datetime.utcnow()

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
==================================== PASSES ====================================
=========================== short test summary info ============================
PASSED ../tests/test_outputs.py::test_01_appsync_api_exists
PASSED ../tests/test_outputs.py::test_02_user_pool_exists
PASSED ../tests/test_outputs.py::test_03_app_client_exists
PASSED ../tests/test_outputs.py::test_04_user_pool_group_tenants_exists
PASSED ../tests/test_outputs.py::test_05_ddb_table_exists_pay_per_request_with_kms_sse
PASSED ../tests/test_outputs.py::test_06_kms_alias_exists_and_pointed_in_ssm
PASSED ../tests/test_outputs.py::test_07_log_group_exists
PASSED ../tests/test_outputs.py::test_08_two_iam_roles_exist
PASSED ../tests/test_outputs.py::test_09_appsync_data_source_exists
PASSED ../tests/test_outputs.py::test_10_two_appsync_functions_exist
PASSED ../tests/test_outputs.py::test_11_two_resolvers_exist
PASSED ../tests/test_outputs.py::test_12_ssm_pointers_resolve
PASSED ../tests/test_outputs.py::test_13_ssm_pointer_values_have_correct_shape
PASSED ../tests/test_outputs.py::test_14_ssm_function_ids_resolve_to_real_functions
PASSED ../tests/test_outputs.py::test_15_api_authentication_type_cognito
PASSED ../tests/test_outputs.py::test_16_user_pool_config_matches_pointer
PASSED ../tests/test_outputs.py::test_17_user_pool_config_default_action_deny
PASSED ../tests/test_outputs.py::test_18_additional_auth_includes_api_key
PASSED ../tests/test_outputs.py::test_19_additional_auth_api_key_appears_exactly_once
PASSED ../tests/test_outputs.py::test_20_additional_auth_does_not_include_iam
PASSED ../tests/test_outputs.py::test_21_user_pool_has_custom_tenant_attribute
PASSED ../tests/test_outputs.py::test_22_app_client_has_no_admin_user_password_flow
PASSED ../tests/test_outputs.py::test_23_svc_role_trusts_appsync
PASSED ../tests/test_outputs.py::test_24_svc_role_uses_specific_table_arn_no_wildcard
PASSED ../tests/test_outputs.py::test_25_svc_role_does_not_allow_dynamodb_scan_or_wildcard
PASSED ../tests/test_outputs.py::test_26_svc_role_grants_kms_decrypt_on_cmk
PASSED ../tests/test_outputs.py::test_27_logs_role_trusts_appsync_and_can_write_logs
PASSED ../tests/test_outputs.py::test_28_svc_role_has_no_admin_managed_policies
PASSED ../tests/test_outputs.py::test_29_get_thing_is_pipeline_resolver
PASSED ../tests/test_outputs.py::test_30_get_thing_pipeline_has_two_functions
PASSED ../tests/test_outputs.py::test_31_get_thing_pipeline_function_order_is_auth_then_data
PASSED ../tests/test_outputs.py::test_32_auth_check_vtl_references_cognito_groups_claim
PASSED ../tests/test_outputs.py::test_33_auth_check_vtl_calls_util_unauthorized_or_error
PASSED ../tests/test_outputs.py::test_34_auth_check_vtl_references_tenants_group_literal
PASSED ../tests/test_outputs.py::test_35_data_fn_vtl_is_getitem_on_arguments_id
PASSED ../tests/test_outputs.py::test_36_data_fn_vtl_does_not_use_scan_or_query_on_full_table
PASSED ../tests/test_outputs.py::test_37_data_fn_request_is_well_formed_getitem
PASSED ../tests/test_outputs.py::test_38_api_cache_per_resolver_caching
PASSED ../tests/test_outputs.py::test_39_api_cache_type_set_and_ttl_non_zero
PASSED ../tests/test_outputs.py::test_40_get_thing_caching_keys_include_id_and_tenant
PASSED ../tests/test_outputs.py::test_41_get_thing_caching_ttl_non_trivial
PASSED ../tests/test_outputs.py::test_42_mutation_addthing_has_no_caching_config
PASSED ../tests/test_outputs.py::test_43_api_key_expiry_within_seven_days
PASSED ../tests/test_outputs.py::test_44_mutation_addthing_kind_unit_against_table
PASSED ../tests/test_outputs.py::test_45_mutation_addthing_putitem_uses_attribute_not_exists_condition
PASSED ../tests/test_outputs.py::test_47_schema_sdl_has_user_pools_directive_on_mutation
PASSED ../tests/test_outputs.py::test_48_log_config_field_log_level_all_with_logs_role
PASSED ../tests/test_outputs.py::test_49_log_config_exclude_verbose_content_false
PASSED ../tests/test_outputs.py::test_50_xray_enabled_on_api
PASSED ../tests/test_outputs.py::test_51_data_source_service_role_set_to_svc_role
PASSED ../tests/test_outputs.py::test_52_data_source_type_is_amazon_dynamodb
PASSED ../tests/test_outputs

… (truncated at 12,000 chars, full verifier log is in the trial artifacts)

Reproduce this trial: git checkout 2f94510 && PYTHONPATH=src python3 scripts/build_site.py , then open trial/trial_51c1529faddd469d. Re-running the agent live requires EVAL_PLATFORM_ENABLE_OAUTH_SMOKE=1 and is non-deterministic.

Trial trial_51c1529faddd469d · verifier authoritative; classifier explanatory.