Pretty hard :) We should do better (I work at AWS) to be more seamless, but we also take protecting customer data very seriously. Internally, it's quite a process, with security and legal and compliance reviews and multi-level approvals, to get access to any information associated with a customer account. I find that re-assuring!

That's one reason for the landing pages like this, which can have their own T&C and it's more clear that the information is being volunteered to team running the preview. It also means the data can be discarded when the preview is done.

AppSync has comprehensive Auth functionality including both AWS IAM and Amazon Cognito, plus FGAC capabilities for you to implement custom rules: https://docs.aws.amazon.com/appsync/latest/devguide/security...