Why your next serverless project
should use AWS AppSync
Yan Cui
http://theburningmonk.com
@theburningmonk
Developer Advocate @
Independent Consultant
AWS user since 2009
since 2018
yan@lumigo.io
Guy Moses
@guymoses3
Software Engineer @
guy@lumigo.io
http://bit.ly/social-network-in-4-weeks
Learn GraphQL and AppSync by building a
Twitter clone with these technologies
appsyncmasterclass.com
What is GraphQL?
A Query Language for your APIs
and a runtime for fulfiling those queries with your existing data
schema
schema server
AppSync
Client Server
schema server
AppSync
schema server data sources
DynamoDB
RDS
ElasticSearch
AppSync
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GraphQL API
POST https://myapp.com/graphql
{
getProfile (id: “1234”) {
firstName
lastName
}
}
{
“firstName”: “Yan”,
“lastName”: “Cui”
}
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GraphQL API
POST https://myapp.com/graphql
{
getProfile (id: “1234”) {
friends {
firstName
lastName
}
}
}
{
“friends”: [{
“firstName”: “Gerard”,
“lastName”: “Sans”
}, {
“firstName”: “Ant”,
“lastName”: “Stanley”
}]
}
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Returns data we don’t need
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Returns data we don’t need
Overfetching
GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Doesn’t have everything we need
GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities
GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities
GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities
Underfetching
n+1 requests
BFFs (Backends for Frontends)
BFF
BFF
Need lots of BFFs
BFF
Need lots of BFFs
Duplicating work
GraphQL = no more bespoke BFFs
AppSync
AppSync
Profile
AppSync
Profile
Profile
Profile
Sport
Profile
Sport
AppSync
Profile
Sport
AppSync
Profile
Sport
Activity
AppSync
Profile
Sport
Activity
AppSync
Profile
Sport
Activity
AppSync
Profile
Sport
Activity
AppSync
Profile
Sport
Activity
very flexible!
Solves problems of overfetching and underfetching
Strongly typed contract between client and server
Implement “joins” with DynamoDB effortlessly
Enables rapid product iterations on the frontend
What is AppSync?
Fully managed GraphQL service
query server data sources
DynamoDB
RDS
ElasticSearch
AppSync
Lambda
HTTP
AppSync supports 5 data sources
AppSync supports 5 data sources
HTTP
Put GraphQL in front of existing
REST APIs
REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
BFF
REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
BFF
REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
BFF
REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
DynamoDB
REST API 1
REST API 2
REST API 3
existing UI page
new UI page
AppSync
DynamoDB
AppSync supports 5 data sources
DynamoDB
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries
AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
ElasticSearch
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries
Search engine
Full-text search
AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
ElasticSearch
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries
Search engine
Full-text search
Lambda
Function as a Service
Integrate with any
other services
scalable & multi-az out of the box
pay as you use ($4.00 per million Query/Mutation operations)
AppSync
Profile
Sport
Activity
built-in caching support
aws.amazon.com/appsync/pricing
AppSync
full request caching
AppSync
per-resolver caching
built-in monitoring
which resolver is
the problem?
NO SERVERS to manage!
AppSync vs API Gateway
Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF
Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with Lambda/DynamoDB/RDS/ElasticSearch
Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with Lambda/DynamoDB/RDS/ElasticSearch
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
API Gateway
bit.ly/2H51WXC
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway
Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway
Group-based authentication
API Gateway has no built-in group-based authentication
1. Assign IAM role to each group to control which endpoints a user can access
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
3. Generate policy for user
How to implement group-based authentication in API Gateway
1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
3. Generate policy for user
How to implement group-based authentication in API Gateway
How to implement group-based authentication in AppSync
API Gateway has request validation but no response validation
Response validation helps prevent data leaks
Security is as much about what your application SHOULD do
as what it SHOULDN’T do
Request and Response validation is built into GraphQL
Websockets
API Gateway
Lambda
OnConnect
API Gateway
Lambda
OnConnect DynamoDB
API Gateway
Lambda
OnConnect DynamoDB
Lambda
OnDisconnect
API Gateway DynamoDB
Lambda
API Gateway DynamoDB
Lambda
low-level construct where YOU have to manage connection mapping
no support for broadcasts
(e.g. broadcasting to a million connected users equates to fetching 1M items
from DynamoDB and then make 1M API calls to API Gateway…)
fine for simple use cases
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
subscriber
publisher
subscriber
subscriber
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
publisher
subscriber
subscriber
subscriber
type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
publisher
subscriber
subscriber
subscriber
much easier to use, and can cater for more complex use cases
aws.amazon.com/blogs/mobile/appsync-realtime
You can also use API Gateway with AppSync
AppSync vs GraphQL in Lambda
API Gateway Lambda
API Gateway Lambda
DynamoDB
RDS
Why?
What you need
What you need
What AppSync offers
What you need
What AppSync offers
What you need
What AppSync offers
What’s missing in
AppSync
No custom scalar types
GraphQL scalar types
ID
String
Int
Float
Boolean
GraphQL scalar types AppSync scalar types
ID
String
Int
Float
Boolean
AWSDate
AWSTime
AWSDateTime
AWSTimestamp
AWSEmail
AWSJSON
AWSURL
AWSPhone
AWSIPAddress
No custom scalar types
No schema stitching
Service A
Resolver A Resolver B Resolver C
graphql
Gateway
Service A Service B Service C
graphql graphql
graphql
graphql
Gateway
Service A Service B Service C
graphql graphql
graphql
graphql
Resolver A Resolver B Resolver C Resolver D Resolver E
Client App
AppSync AppSync AppSync
graphql graphql
graphql
What you need
What AppSync offers
AppSync features you
need to replicate
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Caching
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Resolver logging
Caching
What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Caching
Resolver logging
Group-based auth
with Cognito
More control
Per-resolver metrics
Can add custom middlewares
API Gateway Lambda
API Gateway Lambda
Usage plans
API Gateway Lambda
Usage plans
Lambda
authorizer
API Gateway AppSync
Usage plans
Lambda
authorizer
API Gateway Lambda
Cold starts
AppSync DynamoDB
No Lambda. No
cold starts.
AppSync
Fewer dependencies.
Cold starts faster.
Lambda
What’s missing in
AppSync
AppSync features you
need to replicate
What’s missing in
AppSync
Use AppSync if you can, until you can’t

Why your next serverless project should use AWS AppSync