[Goldloli]

Issue number:
closes #8718

Summary

Changes

• Add AppSyncIdentityLambda, a data class for AWS_LAMBDA authorization identities, exposing the authorizer's resolverContext through resolver_context.
• get_identity_object now dispatches on resolverContext before the IAM fallback. The sub → AppSyncIdentityCognito dispatch and the AppSyncIdentityIAM fallback are unchanged.
• Update the AppSyncEventBase.identity return type and the AWS_LAMBDA docstring line that was marked NEED TO TEST. The OPENID_CONNECT line is left untouched so it can land through docs(data_classes): correct AppSync identity docstring for OPENID_CONNECT and pin the dispatch #8705.
• Add a Lambda-authorizer AppSync resolver event fixture, and tests for the dispatch, the dispatch precedence (sub still wins), and full AppSyncResolverEvent parsing.
• Document AppSyncIdentityLambda in the AppSync Resolver section of docs/utilities/data_classes.md.

User experience

Before: a Lambda-authorizer identity fell through to AppSyncIdentityIAM, so accessing any property (account_id, user_arn, source_ip, ...) raised KeyError, and resolverContext was only reachable as a raw dict.

After:

from aws_lambda_powertools.utilities.data_classes.appsync_resolver_event import get_identity_object

identity = get_identity_object({"resolverContext": {"userId": "u-1", "tier": "gold"}})
assert isinstance(identity, AppSyncIdentityLambda)
identity.resolver_context  # {'userId': 'u-1', 'tier': 'gold'}

Verification

Commands run in this branch:

uv sync --locked
uv run --locked pytest tests/unit/data_classes/required_dependencies/test_appsync_resolver_event.py -q
# 9 passed in 0.10s (3 new tests)

uv run --locked pytest tests/unit/data_classes -q
# 213 passed in 0.77s

uv run --locked ruff format aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py tests/unit/data_classes/required_dependencies/test_appsync_resolver_event.py --check
# 2 files already formatted
uv run --locked ruff check aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py tests/unit/data_classes/required_dependencies/test_appsync_resolver_event.py
# All checks passed!
uv run --locked mypy aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py
# Success: no issues found in 1 source file

docker run -v "$PWD":/markdown 06kellyjac/markdownlint-cli "docs"
# exit 0

Red/green check against develop (public API only, no mocks): with the develop version of get_identity_object, get_identity_object({"resolverContext": {...}}) returns AppSyncIdentityIAM; with this branch it returns AppSyncIdentityLambda and resolver_context contains the expected mapping.

Event shape: the fixture follows the AWS AppSync resolver event shape for Lambda authorizers, where identity is whatever the authorizer returned (resolverContext). No AWS resources are required, matching the note in the issue. I did not validate against a deployed AppSync API.

AI assistance

Per the AI-assisted contribution policy: this change was written with the help of an AI assistant. I reviewed the diff and ran the verification above; no unrelated AI-generated changes are included.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @Goldloli, confirmed against a real AppSync API with a Lambda authorizer: the resolver receives {"resolverContext": {...}} and nothing else, exactly your fixture. On develop that lands on AppSyncIdentityIAM and every property raises, with your change it is an AppSyncIdentityLambda with the context reachable. As I said in the issue, #8705 lands first and touches the same docstring lines, so a small rebase will be needed after it merges, I'll ping you then.

I'm approving now. This goes out in 3.40.0, so it will sit here for a while before I merge it. No rebase needed in the meantime, and you'll be credited in the release notes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.00%. Comparing base (ec1bec2) to head (89fa1ba).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8720   +/-   ##
========================================
  Coverage    97.00%   97.00%           
========================================
  Files          321      321           
  Lines        16415    16421    +6     
  Branches      1482     1483    +1     
========================================
+ Hits         15924    15930    +6     
  Misses         350      350           
  Partials       141      141           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.