Multi-user data access

The ownersDefinedIn rule grants a set of users access to a record by automatically creating an owners field to store the allowed record owners. You can override the default owners field name by specifying inField with the desired field name to store the owner information. You can dynamically manage which users can access a record by updating the owner field.

Add multi-user authorization rule

If you want to grant a set of users access to a record, you use the ownersDefinedIn rule. This automatically creates a owners: a.string().array() field to store the allowed owners.

1const schema = a.schema({
2  Todo: a
3    .model({
4      content: a.string(),
5    })
6    .authorization(allow => [allow.ownersDefinedIn('owners')]),
7});

In your application, you can perform CRUD operations against the model using client.models.<model-name> with the userPool auth mode.

1import { generateClient } from 'aws-amplify/data';
2import type { Schema } from '../amplify/data/resource'; // Path to your backend resource definition
3
4const client = generateClient<Schema>();
5
6// Create a record with current user as first owner
7const { errors, data: newTodo } = await client.models.Todo.create(
8  {
9    content: 'My new todo',
10  },
11  {
12    authMode: 'userPool',
13  }
Copy  highlighted code example
14);

1// Add another user as an owner
2await client.models.Todo.update(
3  {
4    id: newTodo.id,
5    owners: [...(newTodo.owners as string[]), otherUserId],
6  },
7  {
8    authMode: "userPool"
9  }
Copy  highlighted code example
10);

Override to a list of owners

You can override the inField to a list of owners. Use this if you want a dynamic set of users to have access to a record. In the example below, the authors list is populated with the creator of the record upon record creation. The creator can then update the authors field with additional users. Any user listed in the authors field can access the record.

1const schema = a.schema({
2  Todo: a
3    .model({
4      content: a.string(),
5      authors: a.string().array(), // record owner information now stored in "authors" field
6    })
7    .authorization(allow => [allow.ownersDefinedIn('authors')]),
8});