I switched from AppSync Resolvers written in VTL to the Lambda Functions invoked from the AppSync Resolver. The decision was made due to higher flexibility, and easier debugging of the Lambda Functions compared to the the VTL code. Moreover, you do not have to learn a new language syntax, and you can still use your preferred language code (python, nodejs and so on). And the most important, you can write tests of your code and run them in your CI pipelines. With this approach, you can delegate the authorization phase to AppSync itself, and leverage the power of the GraphQL schema.