Accessing graphql api via custom lambda function

[jayarerita]

Amplify CLI Version

Amplify Gen 2 ampx v1.0.4

Question

I have a lambda function which is listening to dynamodb events for one of my tables. Below is a basic example of how my table and function are defined in my backend.ts file.

const backend = defineBackend({
  auth,
  data,
  storage
});
const tableA =  backend.data.resources.tables["TableA"];

const functionA= new LambdaFunction(backend.storage.resources.bucket.stack, 'FunctionA', {
  runtime: LambdaRuntime.NODEJS_20_X,
  handler: 'index.handler',
  code: lambdaCodeFromAssetHelper(
    path.resolve('amplify/functions/function-a/handler.ts'),
    { buildMode: BuildMode.Esbuild }
  ),
  logRetention: RetentionDays.ONE_WEEK,
  timeout: Duration.seconds(120)
});

functionA.addEnvironment("TABLE_A_NAME", tableA.tableName);

const functionAdbPolicy = new PolicyStatement({
  actions: [
    "dynamodb:UpdateItem",
    "dynamodb:GetItem",
  ],
  resources: [
    aTable.tableArn
  ],
});

functionA.addToRolePolicy(functionAdbPolicy);

const functionAStreamsPolicy = new PolicyStatement({
  effect: Effect.ALLOW,
  actions: [
    "dynamodb:DescribeStream",
    "dynamodb:GetRecords",
    "dynamodb:GetShardIterator",
    "dynamodb:ListStreams",
  ],
  resources: [
    Fn.sub("arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${TableName}/stream/*", {
      TableName: tableA.tableName,
    })  ],
});

functionA.addToRolePolicy(functionAStreamsPolicy);

const functionAMapping = new EventSourceMapping(functionStack, "FunctionATableAEventStreamMapping", {
  target: functionA,
  eventSourceArn: tableA.tableStreamArn,
  startingPosition: StartingPosition.LATEST,
});

In the docs you are instructed to add your defined lambda functions as allow.resource(functionWithDataAccess) on the data schema.

I assume this adds permissions, which I can do via cdk, but also provides some key env variables like env.<amplifyData>_GRAPHQL_ENDPOINT and env.AWS_ACCESS_KEY_ID which seem to be needed to configure the amplify data client and perform operations on the graphql api.

It looks like I might be able to access the endpoint url via backend.data.graphqlUrl, but I am not sure where I can get access to the authorization values.