AWS AppSync GraphQL APIs should not be authenticated with API keys

How to fix it

Switch the named API's default authorization mode off API_KEY to one that identifies the caller: AWS_IAM, a Cognito user pool, OpenID Connect, or a Lambda authorizer. Adding the new mode as an additional provider first lets clients move one at a time. Then delete the keys: this check reads the default mode alone, so a key kept as an additional provider still works and still passes. The update operation replaces the API's configuration rather than merging, so carry the logging, tracing and additional provider settings through or they are dropped.

In the console

AppSync → APIs → the API → Settings → Default authorization mode

With Terraform

resource "aws_appsync_graphql_api" "this" {
  name                = var.api_name
  authentication_type = "AWS_IAM"
}