Page updated Apr 19, 2024

Public data access

The public authorization strategy grants everyone access to the API, which is protected behind the scenes with an API key. You can also override the authorization provider to use an unauthenticated IAM role from Cognito instead of an API key for public access.

Add public authorization rule using API key-based authentication

To grant everyone access, use the .public() authorization strategy. Behind the scenes, the API will be protected with an API key.

amplify/data/resource.ts
1const schema = a.schema({
2 Todo: a
3 .model({
4 content: a.string(),
5 })
6 .authorization(allow => [allow.publicApiKey()]),
7});

In your application, you can perform CRUD operations against the model using client.models.<model-name> by specifying the apiKey auth mode.

1import { generateClient } from 'aws-amplify/data';
2import type { Schema } from '../amplify/data/resource'; // Path to your backend resource definition
3
4const client = generateClient<Schema>();
5
6const { errors, data: newTodo } = await client.models.Todo.create(
7 {
8 content: 'My new todo',
9 },
10 {
11 authMode: 'apiKey',
12 }
13);

Add public authorization rule using Amazon Cognito identity pool's unauthenticated role

You can also override the authorization provider. In the example below, identityPool is specified as the provider which allows you to use an "Unauthenticated Role" from the Cognito identity pool for public access instead of an API key. Your Auth resources defined in amplify/auth/resource.ts generates scoped down IAM policies for the "Unauthenticated role" in the Cognito identity pool automatically.

amplify/data/resource.ts
1const schema = a.schema({
2 Todo: a
3 .model({
4 content: a.string(),
5 })
6 .authorization(allow => [allow.guest()]),
7});

In your application, you can perform CRUD operations against the model using client.models.<model-name> with the iam auth mode.

If you're not using the auto-generated amplifyconfiguration.json file, then you must set the Amplify Library resource configuration's allowGuestAccess flag to true. This lets the Amplify Library use the unauthenticated role from your Cognito identity pool when your user isn't logged in.

Amplify configuration
src/App.tsx
1import { Amplify } from "aws-amplify";
2import config from "../amplifyconfiguration.json";
3
4Amplify.configure(
5 {
6 ...config,
7 Auth: {
8 Cognito: {
9 identityPoolId: config.aws_cognito_identity_pool_id,
10 userPoolClientId: config.aws_user_pools_web_client_id,
11 userPoolId: config.aws_user_pools_id,
12 allowGuestAccess: true,
13 },
14 },
15 }
16);
src/App.tsx
1import { generateClient } from 'aws-amplify/data';
2import type { Schema } from '../amplify/data/resource'; // Path to your backend resource definition
3
4const client = generateClient<Schema>();
5
6const { errors, data: newTodo } = await client.models.Todo.create(
7 {
8 content: 'My new todo',
9 },
10 {
11 authMode: 'iam',
12 }
13);