fix(appsync): lambda authorizer permission is not scoped to appsync a…

…pi arn

packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.graphql-lambda-permission.graphql

@@ -0,0 +1,3 @@
+type Query {
+  getMessage: String
+}

packages/@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.graphql-lambda-permission.js.snapshot/aws-graphql-lambda-permissions.template.json

@@ -0,0 +1,128 @@
+{
+ "Resources": {
+  "AuthorizerFunctionServiceRole5B2A061B": {
+   "Type": "AWS::IAM::Role",
+   "Properties": {
+    "AssumeRolePolicyDocument": {
+     "Statement": [
+      {
+       "Action": "sts:AssumeRole",
+       "Effect": "Allow",
+       "Principal": {
+        "Service": "lambda.amazonaws.com"
+       }
+      }
+     ],
+     "Version": "2012-10-17"
+    },
+    "ManagedPolicyArns": [
+     {
+      "Fn::Join": [
+       "",
+       [
+        "arn:",
+        {
+         "Ref": "AWS::Partition"
+        },
+        ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+       ]
+      ]
+     }
+    ]
+   }
+  },
+  "AuthorizerFunctionB4DBAA43": {
+   "Type": "AWS::Lambda::Function",
+   "Properties": {
+    "Code": {
+     "ZipFile": "\n        exports.handler = async (event) => {\n          console.log(\"Authorization event:\", JSON.stringify(event));\n          \n          const isAuthorized = true;\n          if (isAuthorized) {\n            return {\n              isAuthorized: true,\n              resolverContext: {\n                userId: 'user-id-example'\n              }\n            };\n          } else {\n            return {\n              isAuthorized: false\n            };\n          }\n        };\n      "
+    },
+    "Handler": "index.handler",
+    "Role": {
+     "Fn::GetAtt": [
+      "AuthorizerFunctionServiceRole5B2A061B",
+      "Arn"
+     ]
+    },
+    "Runtime": "nodejs18.x"
+   },
+   "DependsOn": [
+    "AuthorizerFunctionServiceRole5B2A061B"
+   ]
+  },
+  "AuthorizerFunctionapiappsync4E3369BF": {
+   "Type": "AWS::Lambda::Permission",
+   "Properties": {
+    "Action": "lambda:InvokeFunction",
+    "FunctionName": {
+     "Fn::GetAtt": [
+      "AuthorizerFunctionB4DBAA43",
+      "Arn"
+     ]
+    },
+    "Principal": "appsync.amazonaws.com"
+   }
+  },
+  "apiC8550315": {
+   "Type": "AWS::AppSync::GraphQLApi",
+   "Properties": {
+    "AuthenticationType": "AWS_LAMBDA",
+    "LambdaAuthorizerConfig": {
+     "AuthorizerUri": {
+      "Fn::GetAtt": [
+       "AuthorizerFunctionB4DBAA43",
+       "Arn"
+      ]
+     }
+    },
+    "Name": "api"
+   }
+  },
+  "apiSchema0EA92056": {
+   "Type": "AWS::AppSync::GraphQLSchema",
+   "Properties": {
+    "ApiId": {
+     "Fn::GetAtt": [
+      "apiC8550315",
+      "ApiId"
+     ]
+    },
+    "Definition": "type Query {\n  getMessage: String\n}"
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}