In this webinar, Yan Cui and Lumigo Software Engineer Guy Moses will discuss some of the power of GraphQL and AppSync and why AppSync + Lambda + DynamoDB should be your stack of choice in 2021 and beyond!

1. Why your next serverless project
should use AWS AppSync

2. Yan Cui
http://theburningmonk.com
@theburningmonk
Developer Advocate @
Independent Consultant
AWS user since 2009
since 2018
yan@lumigo.io

3. Guy Moses
@guymoses3
Software Engineer @
guy@lumigo.io

4. http://bit.ly/social-network-in-4-weeks

5. Learn GraphQL and AppSync by building a
Twitter clone with these technologies
appsyncmasterclass.com

6. What is GraphQL?

7. A Query Language for your APIs
and a runtime for fulfiling those queries with your existing data

8. schema

9. schema server
AppSync

10. Client Server

11. schema server
AppSync

12. schema server data sources
DynamoDB
RDS
ElasticSearch
AppSync

13. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}

14. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GraphQL API
POST https://myapp.com/graphql
{
getProfile (id: “1234”) {
firstName
lastName
}
}
{
“firstName”: “Yan”,
“lastName”: “Cui”
}

15. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
GraphQL API
POST https://myapp.com/graphql
{
getProfile (id: “1234”) {
friends {
firstName
lastName
}
}
}
{
“friends”: [{
“firstName”: “Gerard”,
“lastName”: “Sans”
}, {
“firstName”: “Ant”,
“lastName”: “Stanley”
}]
}

22. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}

23. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Returns data we don’t need

24. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Returns data we don’t need
Overfetching

25. GET https://myapp.com/user/1234
REST API
{
“id”: “1234”,
“firstName”: “Yan”,
“lastName”: “Cui”,
“dob”: “…”,
…
}
Doesn’t have everything we need

26. GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities

27. GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities

28. GET https://myapp.com/user/1234
REST API
GET https://myapp.com/sports/football
GET https://myapp.com/sports/squash
…
GET https://myapp.com/user/1234/activities
Underfetching
n+1 requests

29. BFFs (Backends for Frontends)

30. BFF

31. BFF
Need lots of BFFs

32. BFF
Need lots of BFFs
Duplicating work

33. GraphQL = no more bespoke BFFs

35. AppSync

36. AppSync
Profile

37. AppSync
Profile

38. Profile

39. Profile
Sport

40. Profile
Sport

41. AppSync
Profile
Sport

42. AppSync
Profile
Sport

43. Activity

44. AppSync
Profile
Sport
Activity

45. AppSync
Profile
Sport
Activity

46. AppSync
Profile
Sport
Activity

47. AppSync
Profile
Sport
Activity
very flexible!

48. Solves problems of overfetching and underfetching

49. Strongly typed contract between client and server

50. Implement “joins” with DynamoDB effortlessly

51. Enables rapid product iterations on the frontend

52. What is AppSync?

53. Fully managed GraphQL service

54. query server data sources
DynamoDB
RDS
ElasticSearch
AppSync
Lambda
HTTP

55. AppSync supports 5 data sources

56. AppSync supports 5 data sources
HTTP
Put GraphQL in front of existing
REST APIs

57. REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
BFF

58. REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
BFF

59. REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
BFF

60. REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync

61. REST API 1
REST API 2
REST API 3
REST API 4
existing UI page
new UI page
AppSync
DynamoDB

62. REST API 1
REST API 2
REST API 3
existing UI page
new UI page
AppSync
DynamoDB

63. AppSync supports 5 data sources
DynamoDB
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries

64. AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries

65. AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
ElasticSearch
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries
Search engine
Full-text search

66. AppSync supports 5 data sources
DynamoDB RDS
(Aurora Serverless)
ElasticSearch
NoSQL
High performance
Infinite scale
Semi-schema’d
Simple queries
Relational Database
Complex queries
Search engine
Full-text search
Lambda
Function as a Service
Integrate with any
other services

67. scalable & multi-az out of the box

68. pay as you use ($4.00 per million Query/Mutation operations)

69. AppSync
Profile
Sport
Activity

70. built-in caching support

71. aws.amazon.com/appsync/pricing

72. AppSync
full request caching

73. AppSync
per-resolver caching

74. built-in monitoring

76. which resolver is
the problem?

84. NO SERVERS to manage!

85. AppSync vs API Gateway

86. Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF

87. Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with Lambda/DynamoDB/RDS/ElasticSearch

88. Fully managed GraphQL service
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with Lambda/DynamoDB/RDS/ElasticSearch
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT

89. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
API Gateway

90. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
API Gateway

91. bit.ly/2H51WXC

92. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
API Gateway

93. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
API Gateway

94. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
API Gateway

95. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway

96. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway

97. Fully managed service for REST and Websocket APIs
Caching
Monitoring/Logging
Websockets
WAF
Direct integration with most AWS services
auth: Cognito/AWS_IAM/API_KEY/OPENID_CONNECT/LAMBDA
Custom domain names
Private endpoints
Resource policies
API Gateway

98. Group-based authentication

101. API Gateway has no built-in group-based authentication

102. 1. Assign IAM role to each group to control which endpoints a user can access
How to implement group-based authentication in API Gateway

103. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
How to implement group-based authentication in API Gateway

104. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
How to implement group-based authentication in API Gateway

105. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
How to implement group-based authentication in API Gateway

106. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
How to implement group-based authentication in API Gateway

107. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
3. Generate policy for user
How to implement group-based authentication in API Gateway

108. 1. Assign IAM role to each group to control which endpoints a user can access
2. Assign precedence to each group
3. Use a Lambda authorizer to:
1. Verify user belongs to the Cognito user pool and fetch user’s details
2. Pick a group based on precedence
3. Generate policy for user
How to implement group-based authentication in API Gateway

109. How to implement group-based authentication in AppSync

110. API Gateway has request validation but no response validation

112. Response validation helps prevent data leaks

113. Security is as much about what your application SHOULD do
as what it SHOULDN’T do

114. Request and Response validation is built into GraphQL

116. Websockets

118. API Gateway
Lambda
OnConnect

119. API Gateway
Lambda
OnConnect DynamoDB

120. API Gateway
Lambda
OnConnect DynamoDB
Lambda
OnDisconnect

121. API Gateway DynamoDB
Lambda

122. API Gateway DynamoDB
Lambda

123. low-level construct where YOU have to manage connection mapping

124. no support for broadcasts
(e.g. broadcasting to a million connected users equates to fetching 1M items
from DynamoDB and then make 1M API calls to API Gateway…)

125. fine for simple use cases

127. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}

128. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}

129. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}

130. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
subscriber
publisher
subscriber
subscriber

131. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
publisher
subscriber
subscriber
subscriber

132. type Mutation {
addPost(id: ID! author: String! title: String content: String url: String): Post!
}
type Subscription {
addedPost: Post
@aws_subscribe(mutations: [“addPost"])
}
publisher
subscriber
subscriber
subscriber

134. much easier to use, and can cater for more complex use cases

135. aws.amazon.com/blogs/mobile/appsync-realtime

136. You can also use API Gateway with AppSync

137. AppSync vs GraphQL in Lambda

138. API Gateway Lambda

139. API Gateway Lambda
DynamoDB
RDS

140. Why?

141. What you need

142. What you need
What AppSync offers

143. What you need
What AppSync offers

144. What you need
What AppSync offers
What’s missing in
AppSync

145. No custom scalar types

146. GraphQL scalar types
ID
String
Int
Float
Boolean

147. GraphQL scalar types AppSync scalar types
ID
String
Int
Float
Boolean
AWSDate
AWSTime
AWSDateTime
AWSTimestamp
AWSEmail
AWSJSON
AWSURL
AWSPhone
AWSIPAddress

148. No custom scalar types

151. No schema stitching

153. Service A
Resolver A Resolver B Resolver C
graphql

154. Gateway
Service A Service B Service C
graphql graphql
graphql
graphql

155. Gateway
Service A Service B Service C
graphql graphql
graphql
graphql
Resolver A Resolver B Resolver C Resolver D Resolver E

156. Client App
AppSync AppSync AppSync
graphql graphql
graphql

157. What you need
What AppSync offers
AppSync features you
need to replicate

158. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB

159. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch

160. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS

161. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP

162. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Caching

163. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Resolver logging
Caching

164. What you need
What AppSync offers
AppSync features you
need to replicate
Direct integration
with DynamoDB
Direct integration
with ElasticSearch
Direct integration
with RDS
Direct integration
with HTTP
Caching
Resolver logging
Group-based auth
with Cognito

165. More control

166. Per-resolver metrics

167. Can add custom middlewares

168. API Gateway Lambda

169. API Gateway Lambda
Usage plans

170. API Gateway Lambda
Usage plans
Lambda
authorizer

171. API Gateway AppSync
Usage plans
Lambda
authorizer

172. API Gateway Lambda
Cold starts

173. AppSync DynamoDB
No Lambda. No
cold starts.

174. AppSync
Fewer dependencies.
Cold starts faster.
Lambda

176. What’s missing in
AppSync

177. AppSync features you
need to replicate
What’s missing in
AppSync

178. Use AppSync if you can, until you can’t