I have a working Amplify dev deployment using GraphQl API with AMAZON_COGNITO_USER_POOLS auth. This is a react native app with no requirement to create a user account, so I need to support public (cognito unauth role) users as well as signed in users (owner).

I have two auth models to enforce in my schema. One is READ only for signed in cognito user pool accounts and also for public users. The second is CREATE only for public users and CREATE, READ only for signed in users. Is this correct?

type Tests
@model
@auth(
  rules: [
    { allow: public, provider: iam, operations: [read] }
    { allow: private, provider: iam, operations: [read] }
  ]
) {
  id: ID!
  title: String
}

type Answers
@model
@auth(
  rules: [
    { allow: owner, operations: [create, read] },
    { allow: public, provider: iam, operations: [create] }
  ]
) {
  id: ID!
  answer: String
}

I currently have Tests w only the public auth rule and a signed in user is unable to read, access denied with a get or list request.

Another question, when I want to test with an API client like Postman, how do I get the jwt token for the Auth header for the public (cognito unauth role) user? Currently I can test a signed in user by creating a test user and getting their currentSession().tokens?.idToken?.toString(). I guess amplify will generate this as well for the unauth role user?