Me gustaría saber cómo configurar una función Lambda (AdminFunction) para que solo la puedan invocar los usuarios de un grupo específico (AdminUserGroup). Mi YAML es:

 AdminUserGroup: Type: AWS::Cognito::UserPoolGroup Properties: GroupName: "AdminUserGroup" Description: Contains Staff Users Precedence: 0 UserPoolId: Ref: UserPool AdminFunction: Type: AWS::Serverless::Function Properties: Description: admin functions CodeUri: admin/ Handler: index.lambdaHandler Runtime: nodejs12.x Environment: Variables: USERPOOL_ID: !Ref UserPool VALUE_A: !Ref SomePropA VALUE_B: !Ref SomePropB USER_GROUP_ADMIN: !Ref AdminUserGroup TABLE_NAME: !Ref DynamoTable Policies: - DynamoDBCrudPolicy: TableName: !Ref DynamoTable Events: Users: Type: Api Properties: Path: /admin/{proxy+} Method: ANY Auth: Authorizer: << ONLY ADMIN USERS >>