[ibrhmyi]

Closes #8718

With AppSync AWS_LAMBDA authorization, the resolver event identity is whatever the Lambda authorizer returned in resolverContext (e.g. {"resolverContext": {"userId": "u-1", "tier": "gold"}}). Previously get_identity_object only checked for sub (Cognito) and fell back to AppSyncIdentityIAM for everything else, so a Lambda-authorizer identity was wrapped in AppSyncIdentityIAM and every property on it (account_id, user_arn, ...) raised KeyError; resolverContext was only reachable as a raw dict.

Change

• Added AppSyncIdentityLambda(DictWrapper) with a resolver_context property returning the dict the authorizer produced
• get_identity_object now dispatches on "resolverContext" in identity before the IAM fallback; the sub (Cognito/OIDC) dispatch and the IAM fallback are unchanged
• Updated the identity property return type and docstring (the AWS_LAMBDA line previously said "returns None - NEED TO TEST")
• One line in docs/utilities/data_classes.md documenting which identity class each AppSync authorization type returns

Tests

• New fixture tests/events/appSyncResolverEventLambdaAuth.json (existing fixtures untouched, per repo guidance)
• Four new test cases through AppSyncResolverEvent(event).identity / get_identity_object: class exposes resolver_context, resolverContext identity dispatches to AppSyncIdentityLambda (not AppSyncIdentityIAM), IAM fallback regression without resolverContext, and nested-dict passthrough of resolver_context
• Event shape validated against the AWS AppSync Lambda authorizer identity payload shape documented in the issue (resolverContext only, no sub or IAM fields) — no AWS resources needed
• RED on unmodified code: 3 of 4 new tests failed (ImportError/AppSyncIdentityIAM misclassification); GREEN after fix: 10/10 in the file, 200/200 in tests/unit/data_classes/required_dependencies/; ruff check and ruff format --check clean on the changed files

Related: #8705 deliberately leaves AWS_LAMBDA marked unverified ("no fixture for it") while fixing the OIDC docstring — this PR completes the AWS_LAMBDA piece it deferred. The docstring edits are on adjacent lines, so a trivial rebase may be needed if #8705 merges first.

AI assistance was used for this contribution (implementation and review).

AI assistance was used for implementation and review; all reported verification is recorded above.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[boring-cyborg]

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @ibrhmyi, the code is fine, but @Goldloli asked for this issue a minute before you opened the PR, and we go with whoever claimed it first so people don't duplicate work. I'm closing this one. There are other good first issue items open, and the rule is simple: comment on the issue first, wait for the assignment, then open the PR.