In this pattern, AWS AppSync is configured with a a schema to manage and read todos. The pattern uses an event bridge bus and an EventBridge API destination to trigger the AppSync GraphQL updateTodo mutation when an event that matches the defined rule is received. The AppSync Lambda Authorizer is used as the mode of authorization to verify the provided access token.

This pattern demonstrates configuring the EventBridge API Destination OAuth authorization type. Although this pattern uses Amazon Cognito as the OIDC provider, other providers can be used in a similar capacity. AWS AppSync also offers a built-in OIDC authorizer, this pattern uses the Lambda Authorizer to demonstrate added flexibility.

EventBridge API Destinations uses AWS Secrets Manager to manage client secrets. The cost of storing the secret is included in the pricing for API destinations.

EventBridge caches the JWT access token returned by the API Destination authorization endpoint. The authorization endpoint must return a 401 or 403 HTTP response for EventBridge to renew the access token. This can be seen in the Lambda Authorizer included in this pattern. Your authorization endpoint must return the proper unauthorized error code for the access token to be refreshed.