I added simple authentication to my Flutter app using Amplify. I used npm create amplify@latest -y for creating the Amplify setup and then for the sandbox npx ampx sandbox --outputs-format dart --outputs-out-dir lib. Followed the docs, Gen 2, and it worked well.

This is the content of my backend.ts:

defineBackend({
  auth,
  data,
});

This is in my auth/resource.ts

export const auth = defineAuth({
  loginWith: {
    email: true,
  },
});

And my data/resource.ts

const schema = a.schema({
  Todo: a
    .model({
      content: a.string(),
    })
    .authorization((allow) => [allow.guest()]),
});

export type Schema = ClientSchema<typeof schema>;

export const data = defineData({
  schema,
  authorizationModes: {
    defaultAuthorizationMode: 'iam',
  },
});

This should be the default Amplify generated setup, I don’t think I changed anything.

In my authenticated role policy I must have some custom IoT permissions so I can allow authenticated users subscribe and publish to topics as other non Amplify or DynamoDb related stuff. For instance:

{
    "Effect": "Allow",
    "Action": "iot:*",
    "Resource": "*"
}

After Amplify is done with it’s deployment, I can add that and it works fine, my authenticated users are able to access the specified resources.

However, after any change to the data schema the policy is regenerated and my custom changes are lost. For example, in the Todo schema, changing .authorization((allow) => [allow.guest()]) to .authorization((allow) => [allow.owner()]) causes rewrite of the role policy, which is expected, but no anything custom will survive this.

My question, is there any way I can maintain custom role policy statements while relying on Amplify for it’s handling of the data schema? Having Amplify to manage the policy based on the schema is quite convenient but in most cases an app would need at least few additional rules, how I’m supposed to handle such scenarios without having to edit manually after every policy redeploy?