AWS AppSync

Managed GraphQL and Event API service — query multiple data sources with a single endpoint, real-time subscriptions via WebSockets, and built-in offline sync.

Key point

AWS AppSync is a managed GraphQL API service — a single endpoint that lets clients query exactly the data they need from multiple backends (DynamoDB, Lambda, RDS, HTTP, OpenSearch) in one request.
Key differentiator vs API Gateway: GraphQL (flexible queries, no over-fetching), built-in real-time subscriptions (WebSocket managed by AWS), and offline sync for mobile/web clients.

AWS AppSync is a fully managed service for building GraphQL and Event APIs — it provides a single endpoint to query, mutate, and subscribe to data from multiple sources with built-in real-time updates, caching, and offline synchronisation for mobile and web applications.

Core Concepts

Concept	Description
GraphQL Schema	Defines types, queries, mutations, and subscriptions — the contract between client and API
Query	Read operation — clients request exactly the fields needed, avoiding over-fetching
Mutation	Write operation — create, update, or delete data in backend sources
Subscription	Real-time push via WebSocket — clients receive updates when data changes
Resolver	Maps a GraphQL field to a data source — contains request and response mapping templates
Pipeline Resolver	Chains multiple functions (resolvers) in sequence for complex operations
Data Source	Backend that AppSync connects to: DynamoDB, Lambda, RDS (Aurora), HTTP endpoint, OpenSearch, EventBridge
Merged API	Combines multiple AppSync source APIs into a single endpoint for federated GraphQL
Event API	Pub/sub API for real-time event broadcasting — publish and subscribe without GraphQL schema
Caching	Optional server-side cache (ElastiCache-backed) to reduce resolver invocations
Conflict Detection	Versioned data sync for offline clients — detects and resolves write conflicts automatically

How AppSync Works

Client (Web / Mobile / IoT)
    → AppSync Endpoint (single GraphQL URL)
        → Schema + Resolvers
            ├── DynamoDB (direct resolver — no Lambda needed)
            ├── Aurora Serverless (RDS Data API)
            ├── Lambda (custom business logic)
            ├── HTTP Endpoint (any REST API)
            ├── OpenSearch (full-text search)
            └── EventBridge (emit events)
        ← Aggregated response (exactly the fields requested)

Real-time:
    Client ←── WebSocket ←── AppSync Subscription
                              (triggered by mutations)

Data Sources

Data Source	Use Case	Resolver Type
Amazon DynamoDB	Primary NoSQL data store — direct CRUD without Lambda	VTL or JS runtime
AWS Lambda	Custom business logic, external API calls, transforms	VTL or JS runtime
Amazon RDS	Relational queries via Aurora Serverless Data API	VTL or JS runtime
HTTP Endpoint	Proxy to any REST API or microservice	VTL or JS runtime
Amazon OpenSearch	Full-text search and analytics queries	VTL or JS runtime
Amazon EventBridge	Emit events to EventBridge from mutations	VTL or JS runtime
None	Local resolver — transform data without a backend call	VTL or JS runtime

AppSync vs API Gateway

Criteria	AppSync	API Gateway
API style	GraphQL (single endpoint, flexible queries)	REST / HTTP (resource-based, fixed endpoints)
Data fetching	Client selects exact fields — no over-fetching	Server defines response shape per endpoint
Multiple data sources	Single query resolves across multiple backends	One integration per endpoint
Real-time	Built-in subscriptions (managed WebSocket)	WebSocket API (manual connection management)
Offline sync	Built-in conflict detection and resolution	Not supported
Caching	Optional (dedicated cache instance)	Built-in (REST API only)
Auth options	API key, Cognito, IAM, OIDC, Lambda authorizer	API key, Cognito, IAM, JWT, Lambda authorizer
Throttling / API keys	Rate limiting via WAF; API keys for auth only	Built-in usage plans + API keys
Best for	Data-rich apps, real-time dashboards, mobile sync	REST APIs, serverless backends, AWS service proxy

Authorization Methods

Method	Description
API Key	Simple token for public or development access (expiry up to 365 d)
Amazon Cognito	User pool-based auth — group-level and field-level access control
IAM	SigV4 signing — for server-to-server or AWS service calls
OIDC	Any OpenID Connect-compliant identity provider
Lambda Authorizer	Custom auth logic (OAuth, SAML, custom tokens)

AppSync supports multiple auth modes on a single API — different types or fields can use different auth methods.

Real-time Subscriptions

1. Client subscribes:    subscription { onCreateMessage { id text } }
2. Another client mutates: mutation { createMessage(text: "hello") { id } }
3. AppSync pushes update via WebSocket to all subscribed clients

Managed WebSocket connection — no infrastructure to maintain.
Subscriptions are triggered by mutations defined in the schema.
Scales to millions of concurrent connections.
Secured by the same auth methods as queries and mutations.

Offline and Conflict Resolution

Feature	Description
Offline support	Amplify DataStore caches data locally; queues mutations while offline
Conflict detection	Versioned records detect concurrent writes from multiple offline clients
Resolution strategy	Auto-merge, optimistic concurrency, Lambda-based custom resolution

SAA/SAP Tip: "Mobile app that works offline and syncs when back online" → AWS AppSync with Amplify DataStore. API Gateway does not have built-in offline sync or conflict resolution.

Common Use Cases

Data-rich mobile/web apps — Single GraphQL endpoint aggregates data from DynamoDB, RDS, and external APIs in one query.
Real-time dashboards — Subscriptions push live updates (scores, stock prices, IoT telemetry) to connected clients via WebSocket.
Offline-first mobile apps — Amplify DataStore + AppSync sync data when connectivity resumes with conflict resolution.
Federated API — Merged API combines multiple team-owned AppSync APIs into a single company-wide GraphQL endpoint.
AI gateway — AppSync resolves queries to Amazon Bedrock for generative AI responses integrated with application data.

SAA/SAP Exam Tips

SAA Tip: "GraphQL API" or "single endpoint to query multiple data sources" → AWS AppSync. API Gateway is REST/HTTP — not GraphQL.

SAA Tip: "Real-time updates pushed to clients" + "managed WebSocket" → AppSync subscriptions. API Gateway WebSocket API requires manual connection management.

SAP Tip: AppSync resolvers can connect directly to DynamoDB without Lambda in between. This reduces latency and cost for simple CRUD operations. Use Lambda resolvers only when custom business logic is needed.

Cross-Cloud Equivalents

Provider	Service / Solution	Notes
AWS	AWS AppSync	Baseline
Azure	Azure API Management (GraphQL pass-through)	No fully managed GraphQL service
GCP	Apigee + custom GraphQL server	No native managed GraphQL
On-Premises	Apollo Server, Hasura, GraphQL Yoga	Open-source GraphQL servers and gateways

Pricing Model

Dimension	Unit	Notes
Query and mutation requests	$4.00 per million	Per 5 KB payload
Real-time updates	$2.00 per million	Outbound messages and WebSocket operations
Connection minutes	$0.08 per million min	Charged while clients are connected via WebSocket
Event API operations	$1.00 per million	Publish, subscribe, and broadcast operations
Caching	Per instance hour	Optional — instance sizes from cache.small upward

Amazon API Gateway — REST/HTTP API management; use when GraphQL is not needed
Amazon DynamoDB — primary NoSQL data source for AppSync resolvers
AWS Lambda — custom resolver logic for complex business operations
Amazon EventBridge — AppSync can emit events to EventBridge from mutations
Amazon Cognito — user pool authentication for AppSync APIs