serverless.yml

    AuthRole:
      Type                                : AWS::IAM::Role
      Description                         : "Role that the an authenticated user assumes"
      Properties:
        RoleName                          : ${self:provider.apiname}-auth
        AssumeRolePolicyDocument:
          Version                         : "2012-10-17"
          Statement:
            - Effect                      : Allow
              Principal:
                Federated                 : cognito-identity.amazonaws.com
              Action                      : sts:AssumeRoleWithWebIdentity
              Condition:
                ForAnyValue:StringLike:
                  "cognito-identity.amazonaws.com:amr": "authenticated"
        Policies:
          - PolicyName                    : ${self:provider.apiname}-auth-appsync
            PolicyDocument:
              Version                     : "2012-10-17"
              Statement:
                - Effect                  : Allow
                  Action                  : appsync:GraphQL
                  Resource:
                    - { Fn::Join: [ '', [ { Ref: GraphQlApi }, '/types/Query/fields/*' ] ] }
                    - { Fn::Join: [ '', [ { Ref: GraphQlApi }, '/types/Subscription/fields/*' ] ] }
                    - { Fn::Join: [ '', [ { Ref: GraphQlApi }, '/types/Mutation/fields/updateUser' ] ] }