This document discusses API modernization with GraphQL and AWS AppSync. It provides an overview of prerequisites and the agenda, which includes modernization use cases, customizations like authorization and caching, and operating GraphQL APIs at scale. It also provides examples of how AWS AppSync can be used to build universal, real-time APIs that connect to various data sources and support features like offline usage.

1. Stefano Sandrini
Sr EMEA Specialist SA, AWS Mobile
@electricste
API Modernization with GraphQL
Advanced use cases

2. Prerequisites
GraphQL Fundamentals
AWS Fundamentals & AppSync fundamentals
API Concepts Fundamentals

3. Agenda
Modernization
Modernization with GraphQL & AWS AppSync
Use cases
Customizations
Operating at scale

4. Agenda. Use Cases, Customizations, Operation
Complex business logic VS Complex resolvers
Authorization
Offline and Caching
Conflict resolution, delta sync, API Cache vs Resolver Cache
Plug in any data source… for offline and real-time !
Multiple auth method, users vs systems, auth for real-time use cases

5. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.
https://commons.wikimedia.org/wiki/File:Blue_Origins_New_Glenn_Launch_(29350547990).png

6. Why modernization?
Build
efficient APIs
Build
reusable and
scalable APIs
Engage
with customers
Deliver the
right data at the
right time
Develop
applications faster

7. Today, customers are building:
Universal APIs
Enterprise data
Apps connect to many
data sources
Real-time apps
Chat functionality
Fan engagement
Location-aware notifications
Mobile-first apps
Consumer
IoT/connected
Field service
Offline support

8. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.
GraphQL, the GraphQL logo and any related marks are trademarks of Facebook, Inc.

10. AWS AppSync
Conflict detection and
resolution in
the cloud
GraphQL facade for any
AWS service
Enterprise security features:
IAM, Amazon Cognito, OIDC,
API keys
Managed serverless
GraphQL service
Add data sync, real-time, and
offline capabilities for any
data source or API
Connect to data sources
in
your account

11. AWS AppSync
Amazon DynamoDB
Amazon Aurora
Amazon Elasticsearch
Service (Amazon ES)
AWS Lambda
HTTP
query sync {
syncPosts {
items {
id
}
}
}
Query language
for APIs
Runtime for fulfilling
those queries
GraphQL, the GraphQL logo and any related marks are trademarks of Facebook, Inc.
Local
(publish/subscribe)
Your
existing data

12. AWS AppSync
Amazon DynamoDB
Amazon Aurora
Amazon Elasticsearch
Service (Amazon ES)
AWS Lambda
HTTP
query sync {
syncPosts {
items {
id
}
}
}
Query language
for APIs
Runtime for fulfilling
those queries
GraphQL, the GraphQL logo and any related marks are trademarks of Facebook, Inc.
Local
(publish/subscribe)
Your
existing data

13. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. Sometimes…

21. Sometimes…
!?!??!!?!?!?!!

22. Direct Lambda resolver
AWS AppSync
AWS Lambda

23. Direct Lambda resolver
AWS AppSync
AWS Lambda
Optional

24. Direct Lambda resolver
AWS AppSync
AWS Lambda
Optional
Info Object

25. Direct Lambda resolver
AWS AppSync
AWS Lambda
Optional
Info Object

26. Direct Lambda resolver
AWS AppSync
AWS Lambda
Optional
Info Object

27. Direct Lambda resolver
AWS AppSync
AWS Lambda
Optional
Info Object

28. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. Multi-auth
• Authorization on
• Type
• Operation
• Field
• Default auth mode
• Additional providers AWS AppSync
AWS Cloud
Data sources

30. Security
Identity and
Access Management

31. Multi-auth
type Flight
@aws_api_key
@aws_cognito_user_pools (cognito_groups: [”FrequentFlyers"])
@aws_iam
{
id: ID! @aws_api_key @aws_iam
departureDate: String!
departureAirportCode: String! @aws_api_key
departureAirportName: String! @aws_api_key
departureCity: String!
departureLocale: String!
arrivalDate: String!
arrivalAirportCode: String! @aws_iam
arrivalAirportName: String! @aws_iam
arrivalCity: String! @aws_iam
arrivalLocale: String! @aws_iam
ticketPrice: Int!
ticketCurrency: String!
flightNumber: Int!
seatAllocation: Int
seatCapacity: Int!
}

32. AWS AppSync – authorization modes
Sign in with OIDC idP
Use JSON web tokens (JWTs)
When to use
Existing user directory
Authenticating users in app
Not interacting with other
AWS services
OpenID Connect
Granular access control based on claims
#set( $userGroups =
ctx.identity.claims.get("oidc:groups”))
#set( $allowedGroups = ["Bloggers", "Readers"] )
#foreach( $userGroup in $userGroups )
#if( $allowedGroups.contains($userGroup) )
#set( $isStaticGroupAuthorized = true )
#break
#end
#end
#if( !($isStaticGroupAuthorized == true ) )
$util.unauthorized()
#end

33. AppSync – authorization modes
Backend systems
AWS credentials
IoT systems
When to use
Amazon EC2 instances
AWS Lambda functions
AWS Identity and Access Management (IAM)
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["appsync:GraphQL"],
"Resource": [
"arn:*:apis/GraphQLApiId/types/Query/fields/<field>",
"arn:*:apis/GraphQLApiId/types/Mutation/fields/<field>",
"arn:*:apis/GraphQLApiId/types/Post/fields/<field>"
]
}]
}

34. Multi-auth
type Mutation {
createFlight(input: CreateFlightInput!, condition:
ModelFlightConditionInput): Flight @aws_iam
}
type Subscription {
onCreateFlight: Flight @aws_subscribe(mutations:
["createFlight"]) @aws_iam
}

35. Multi-auth for real-time: Chat application
Get signature for signed URL
based on identity
getSignedPolicy Secrets Manager
Conversations
User conversations
Messages DynamoDBB
Stream
readCountUpdater
uploadHandler
putObject event
Update message with
attachment/thumbnail
Update user conversation’s
read count
Media Bucket
Distribution
Download Upload
chatAPI
postConfirmTrigger
UserPool
Users

36. Multi-auth for real-time
Subscription
Resolver

37. Amazon
DynamoDB
Real-time GraphQL subscriptions
AWS
AppSync
AppSync data sources
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel

38. Amazon
DynamoDB
Real-time GraphQL subscriptions
AWS
AppSync
AppSync data sources
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel
Secure WebSocket channel

39. Real-time GraphQL subscriptions
AWS
AppSync
AppSync data sources
Amazon
DynamoDB

40. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

41. Amazon DynamoDB
(User Profiles)
Amazon API Gateway
(Order Service)
AWS Lambda
(Inventory Service)
API Consumers
(Front-end Clients or
other Backend Services)
Amazon Aurora
(Pricing)

42. Cache
Full API Caching
Per Resolver Caching
Encryption

43. AppSync Cache
• Managed server-side caching
• Full API Caching
• Per Resolver Caching
• Encryption

44. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

45. Amplify DataStore: developer experience
Model app data
and relationships
(locally or in admin UI)
Set up
authentication and
authorization
Work with app data using an “offline-first” programming
model—receive updates to shared data in real-time

46. Closer look at the DataStore API
?

47. Define: DataStore-compliant API
Supports a Sync operation for
all models
Supports a subscription operation
for all models
May Support create/update/delete
operations for some models
Selection sets specify mandatory
fields for each model
id
_lastChangedAt
_version
_deleted
When it exists, selection sets specify
mandatory fields of a parent model
Id
_deleted (as a minimum)

48. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.

49. Private subnet
Plug in any data source with AWS Lambda
AWS Lambda Service VPC VPC
AWS Cloud
Security group

50. Thank you!
© 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Stefano Sandrini
Sr EMEA Specialist SA, AWS Mobile
@electricste