Page updated Apr 12, 2024

Signed-in user data access

The private authorization strategy restricts record access to only signed-in users authenticated through IAM, Cognito, or OpenID Connect, applying the authorization rule to all users. It provides a simple way to make data private to all authenticated users.

Add signed-in user authorization rule

You can use the private authorization strategy to restrict a record's access to every signed-in user.

Note: If you want to restrict a record's access to a specific user, see Per-user/per-owner data access. The private authorization strategy detailed on this page applies the authorization rule for data access to every signed-in user.

In the example below, anyone with a valid JWT token from the Cognito user pool is allowed access to all Todos.

amplify/data/resource.ts
1const schema = a.schema({
2 Todo: a
3 .model({
4 content: a.string(),
5 })
6 .authorization([a.allow.private()]),
7});

In your application, you can perform CRUD operations against the model using client.models.<model-name> with the userPool auth mode.

1import { generateClient } from 'aws-amplify/data';
2import type { Schema } from '../amplify/data/resource'; // Path to your backend resource definition
3
4const client = generateClient<Schema>();
5
6const { errors, data: newTodo } = await client.models.Todo.create(
7 {
8 content: 'My new todo',
9 },
10 {
11 authMode: 'userPool',
12 }
13);

Use identity pool for signed-in user authentication

You can also override the authorization provider. In the example below, identityPool is specified as the provider which allows you to use an "Unauthenticated Role" from the Cognito identity pool for public access instead of an API key. Your Auth resources defined in amplify/auth/resource.ts generates scoped down IAM policies for the "Unauthenticated role" in the Cognito identity pool automatically.

amplify/data/resource.ts
1const schema = a.schema({
2 Todo: a
3 .model({
4 content: a.string(),
5 })
6 .authorization([a.allow.private('identityPool')]),
7});

In your application, you can perform CRUD operations against the model using client.models.<model-name> with the iam auth mode.

The user must be logged in for the Amplify Library to use the authenticated role from your Cognito identity pool.

1import { generateClient } from 'aws-amplify/data';
2import type { Schema } from '../amplify/data/resource'; // Path to your backend resource definition
3
4const client = generateClient<Schema>();
5
6const { errors, data: newTodo } = await client.models.Todo.create(
7 {
8 content: 'My new todo',
9 },
10 {
11 authMode: 'iam',
12 }
13);

In addition, you can also use OpenID Connect with private authorization. See OpenID Connect as an authorization provider.