Using aws secretsmanager with appsync

Question

Pulumi · Accepted Answer

To use AWS Secrets Manager with AWS AppSync in a Pulumi program, you would typically do the following:

1. Create a secret in AWS Secrets Manager to hold any sensitive information that your AppSync resolvers might need, like database credentials or API keys.
2. Create an AWS AppSync GraphQL API which would serve as the front-end to your data sources.
3. Define an AppSync DataSource. This is where you'd configure the connection to your actual data store (e.g., an Amazon DynamoDB table, a lambda function, or an HTTP endpoint). If this data store requires credentials, you can reference the AWS Secrets Manager secret.
4. Create an AppSync Resolver, which would connect your AppSync API's fields to the data sources, enabling you to resolve queries and mutations. The resolver can use the credentials stored in Secrets Manager to authenticate requests to the underlying data store.

Below is an example program that illustrates how these resources come together in Pulumi using TypeScript:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an AWS Secret to store sensitive information such as database credentials
const secret = new aws.secretsmanager.Secret("mySecret", {
    description: "My secret for AppSync DataSource",
    // You can leave other attributes like `secretString` or generate a random one with `generateSecretString`
});

// Define an AWS AppSync GraphQL API
const api = new aws.appsync.GraphQLApi("myApi", {
    authenticationType: "API_KEY",
    // `schema` defines the schema of your GraphQL API in SDL format
    schema: `type Query { hello: String }`,
});

// Define an AppSync DataSource that uses the secret
const dataSource = new aws.appsync.DataSource("myDataSource", {
    apiId: api.id,
    name: "myDataSource",
    type: "AWS_LAMBDA",
    lambdaConfig: {
        functionArn: "arn:aws:lambda:us-east-1:123456789012:function:myFunction", // Replace with your Lambda function ARN
    },
    serviceRoleArn: "arn:aws:iam::123456789012:role/appsync-datasource-role", // Replace with the correct role ARN
    // If needed, specify the Secrets Manager ARN in the configuration for data sources that require it
});

// Create an AppSync Resolver for a query
const resolver = new aws.appsync.Resolver("myResolver", {
    apiId: api.id,
    type: "Query",
    field: "hello",
    dataSource: dataSource.name,
    // Setup request and response mapping here - VTL templates to translate between GraphQL and the backend
    requestTemplate: `{
        "version": "2017-02-28",
        "operation": "Invoke",
        "payload": $util.toJson($context.arguments)
    }`,
    responseTemplate: `$util.toJson($context.result)`,
});

// Output the API URL to be consumed by clients
export const apiUrl = api.uris["GRAPHQL"];
```

In this example:

- We create a secret in AWS Secrets Manager, which could store things like database credentials.
- We define an AWS AppSync GraphQL API with an associated schema.
- We define an AWS AppSync DataSource, which would be the link to our actual backend service, such as a Lambda function or an HTTP endpoint. For simplicity, we have defined a Lambda function as our data source, but you could use other types, such as Amazon DynamoDB or Amazon Elasticsearch, depending on your requirements.
- We create an AWS AppSync Resolver, which specifies how a GraphQL query translates into a backend request and vice versa. The VTL (Velocity Template Language) request and response templates are needed to map between the GraphQL request/response and the backend data format.

Please replace placeholder values (like Lambda `functionArn` and IAM `roleArn`) with actual values from your AWS environment. Also, note that the schema used here is a minimalist example for demonstration purposes and would need to be adapted to fit the real data requirements of your application.