Use OpenID Connect as an authorization provider

Private, owner, and group authorization can be configured with an OpenID Connect (OIDC) authorization mode. Add "oidc" to the authorization rule as the provider. Use the oidcAuthorizationMode property to configure the OpenID Connect provider name, OpenID Connect provider domain, Client ID, Issued at TTL, and Auth Time TTL.

The example below highlights the supported authorization strategies with a oidc authorization provider. For owner and group-based authorization, you also will need to specify a custom identity and group claim.

1// amplify/data/resource.ts
2import { a, defineData, type ClientSchema } from "@aws-amplify/backend";
3
4const schema = a.schema({
5  Todo: a.model({
6    content: a.string(),
7  })
8  .authorization([
9    a.allow.owner("oidc").identityClaim("user_id"),
10    a.allow.private("oidc"),
11    a.allow
12      .specificGroups(["testGroupName"], "oidc")
13      .withClaimIn("user_groups"),
14  ]),
15});
16
17export type Schema = ClientSchema<typeof schema>;
18
19export const data = defineData({
20  schema,
21  authorizationModes: {
22    oidcAuthorizationMode: {
23      oidcProviderName: "oidc-provider-name",
24      oidcIssuerUrl: "https://example.com",
25      clientId: "client-id",
26      tokenExpiryFromAuthInSeconds: 300,
27      tokenExpireFromIssueInSeconds: 600,
28    },
29  },
30});