Question: I'm currently using OleDB.

My problem is I can't select my table when searching it using textbox.

This is my code:

```
OleDbCommand inv = new OleDbCommand("Select [Part Number], [Part Name], [Ordered Quantity], [Arrived Quantity] From '"+textBox1.Text+"%'", PartsDB);
OleDbDataAdapter adapt = new OleDbDataAdapter(inv);
DataTable dt = new DataTable();
adapt.Fill(dt);
dataGridView2.DataSource = dt;

```

Answer: 
AWS consoles are pretty separate from the roles which the current user has assumed, so it's expected behavior for it to just fail and say you're not authorized if the signed in user tries to overstep that role. 

As far as APIs and schemas, an API is defined by the schema document. You must create an API first, then set the schema for that API. StartSchemaCreation is an AppSync API that 'upserts' the schema (save it no matter what does or doesn't exist already) for a GraphQL API, however that requires it to already exist.

Creating an API is done via CreateGraphQLApi, the API that error message says is missing in your permissions. As Gabe said in a comment, you could just add that permission to the policy you're using. Alternatively, the AWSAppSyncAdministrator managed policy has "appsync:\*" allowed, so that should allow you to create an API and set the schema. It's worth noting that that's intended as more of a CLI administrator, and is missing some permissions needed to fully use the AppSync console.

Most of the samples on the AppSync console are done via CloudFormation instead of individual calls to the AppSync service, so the permissions required are different. With the blank schema, however, you're calling the CreateGraphQLApi API directly. That would be why the sample worked but blank schema did not.

Edit:

You might be able to get the console piece working with these additional permissions:

```
...
                "iam:ListRoles",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "lambda:AddPermission2*",
                "lambda:ListFunctions2*",
                "es:DescribeElasticsearchDomain",
                "es:ListDomainNames",
                "dynamodb:CreateTable",
                "dynamodb:DescribeTable",
                "dynamodb:ListTables",
                "cognito-idp:ListUserPools"
...

```

Specifically, those are the operations the AppSync console *can* do, I'd bet you're running into the iam ones though. AppSync uses them to give the service permission to access those data sources (e.g. if you have a DynamoDB table as a datasource, it'll create a role that the service can assume to read from and write to that table). 

You can filter out the es (ElasticSearch), DynamoDB, and Lambda permissions if you are not trying to create a data source of those types, and the Cognito if you don't use Cognito auth.

As a security best practice, please do make sure you lock down the resources these can apply to and/or remove these permissions when you no longer need them, as those iam permissions are very powerful.
I had the same issue recently and I was able to fix it.

1. Go to IAM dashboard in your AWS Console and navigate to `Roles`
2. Search for your admin access role (Mine was something like us-east-XXXX\_Full-access)
3. Click on that role and you should only see `AdministratorAccess-Amplify` and `Full-access-Policy`, but nothing for AWS AppSync
4. Click `Add Permissions` and `Attach Policies`
5. Find the `AWSAppSyncAdministrator` policy and add that policy. After adding this, my access errors went away :)