According to AWS AppSync's Website: With AppSync, your app can access data in Amazon DynamoDB, trigger AWS Lambda functions, or run Amazon Elasticsearch queries.
You can think of it as a gateway for clients to access different backends (data sources), defined by mapping templates attached to GraphQL fields (resolvers).
AppSync supports DynamoDB and ElasitcSearch queries natively, but if you want to perform business logic you will have to add a AWS Lambda data source and then use AWS SDKs to R/W DynamoDB or anything else such as another API or maybe even an excel file!
Additionally, you can use Apache VTL along with AppSync's available helpers such as $context to help you perform authorization or field data access based on permissions. Keep in mind that your DynamoDB or ES resolver can only perform 1 operation at the end, Apache VTL only helps you build the resolver that will be run by AppSync.
Here are two diagrams that compare a traditional approach vs appsync

