title: AWS Amplify GraphQL authorization based on field values
body: <p>I have an AWS Amplify project that has three different user groups in Cognito. An Admin, Instructor, and Student group. I also have a GraphQL Schema that looks like this.</p>
  <pre><code>type DriveTime @model {
    id: ID!
    start: AWSDateTime!
    end: AWSDateTime!
    openRegistration: AWSDateTime!
    closeRegistration: AWSDateTime!
    vehicle: Vehicle @connection(name: &quot;VehicleDriveConnection&quot;)
    instructor: Instructor @connection(name: &quot;InstructorDriveConnection&quot;)
    student: Student @connection(name: &quot;StudentDriveConnection&quot;)
    evaluation: DriveEvaluation @connection(name: &quot;DriveEvaluationConnection&quot;)
  }
  </code></pre>
  <p>Basically Admins or Instructors put in times that the students can then register for.</p>
  <p>I want to create authorization rules that allow for the following:</p>
  <ul>
  <li><p>Admin group can read, write, update, and delete anything anything.</p>
  </li>
  <li><p>Instructor group can read, write, update, and delete anything anything.</p>
  </li>
  <li><p>Student group can only read if (the current date is within the openRegistration and closeRegistration fields) or (the student field matches the logged in student).</p>
  </li>
  <li><p>If the current date is within the openRegistration and closeRegistration fields and the student field is null, then the student can register themself for the DriveTime.</p>
  </li>
  <li><p>If the student field matches the logged in student, and the current date is before the start field, the student can write to the student field to unregister or cancel.</p>
  </li>
  </ul>
  <p>Is Amplify GraphQL @Auth capable of this?</p>