Bug: AppSync identity from a Lambda authorizer (AWS_LAMBDA) is wrapped in AppSyncIdentityIAM #8718

Expected Behaviour

With AppSync AWS_LAMBDA authorization, the resolver event identity is what the authorizer returned in resolverContext, for example {"resolverContext": {"userId": "u-1", "tier": "gold"}}. AppSyncResolverEvent.identity should return a dedicated class exposing resolver_context, so the only field that exists in this mode is reachable through a typed property.

Current Behaviour

get_identity_object in aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py has two outcomes: an identity with sub becomes AppSyncIdentityCognito, anything else becomes AppSyncIdentityIAM. A Lambda-authorizer identity has neither sub nor IAM fields, so it lands on AppSyncIdentityIAM and every property on it (account_id, user_arn, source_ip, cognito_identity_*) raises KeyError. resolverContext is only reachable as a raw dict.

Code snippet

from aws_lambda_powertools.utilities.data_classes.appsync_resolver_event import get_identity_object

identity = get_identity_object({"resolverContext": {"userId": "u-1", "tier": "gold"}})
print(type(identity).__name__)  # AppSyncIdentityIAM
identity.account_id  # KeyError: 'accountId'

Possible Solution

• Add AppSyncIdentityLambda(DictWrapper) with a resolver_context property returning the dict the authorizer produced (see the AppSync docs on Lambda authorization: the identity object carries resolverContext).
• In get_identity_object, dispatch on "resolverContext" in identity before the IAM fallback, and update the return type of identity and the docstring line that docs(data_classes): correct AppSync identity docstring for OPENID_CONNECT and pin the dispatch #8705 left marked as unverified.
• Add a fixture with a Lambda-authorizer identity under tests/events/, tests through AppSyncResolverEvent(event).identity, and a line in docs/utilities/data_classes.md.
• Keep the existing dispatch for sub (Cognito and OIDC) and the IAM fallback unchanged.

This is a good first issue. Everything needed is in the file above plus the tests next to it; no AWS resources are required to reproduce.

Powertools for AWS Lambda (Python) version

latest

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs

No response