5-api-access-group.ts

private createApiAccessGroup(
    api: appsync.CfnGraphQLApi
): iam.Group {
    const name = 'ApiAccessGroup';
    const group = new iam.Group(this, name, {
        groupName: name
    });

    group.attachInlinePolicy(this.createApiAccessPolicy(api));

    return group;
}

private createApiAccessPolicy(
    api: appsync.CfnGraphQLApi
): iam.Policy {
    const name = 'ApiAccessPolicy';

    return new iam.Policy(this, name, {
        policyName: name,
        statements: [new iam.PolicyStatement({
            effect: iam.Effect.ALLOW,
            actions: [ 'appsync:GraphQL' ],
            resources: [ api.attrArn + '/*' ]
        })]
    });
}