title: AWS Appsync - IAM permission
body: <p>I'm trying to protect my AWS Appsync API with IAM. All is fine on query level, but <strong>is it possible to restrict a client also on type level (fields of return type)</strong>?</p>
  <p>This is a schema:</p>
  <pre><code>type Query {
      getUserById(id: String): User
  }
  
  type User {
      id: String!
      email: String
      firstName: String
      lastName: String
  }
  </code></pre>
  <p>And desired IAM permission:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: &quot;appsync:GraphQL&quot;,
              &quot;Resource&quot;: [
                  &quot;arn:aws:appsync:REG:ACCNO:apis/APIID/types/Query/fields/getUserById&quot;,
                  &quot;arn:aws:appsync:REG:ACCNO:apis/APIID/types/User/fields/id&quot;,
                  &quot;arn:aws:appsync:REG:ACCNO:apis/APIID/types/User/fields/email&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;
          }
      ]
  }
  </code></pre>
  <p>I want a client to be able to get only user ID and email. Not firstName, nor lastName.
  How to do it?</p>
  <ul>
  <li>I cannot find any info in doc whether it is possible or not.</li>
  <li>Based on this blog: <a href="https://aws.amazon.com/blogs/mobile/graphql-security-appsync-amplify/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/mobile/graphql-security-appsync-amplify/</a> it seems it's possible, but it's not explicit.</li>
  </ul>