Проблема с доступом к DynamoDB из Lambda функции в Amplify

Что я хочу сделать?

Я хочу создать REST API которое возвращает данные из моей таблицы в DynamoDB которая была создана через GraphQL модель.

Что я делаю

1. Создаю GraphQL модель

type Public @model {
  id: ID!
  name: String!
}

2. Создаю REST API с Lambda функцией с доступом к моей PublicTable таблице

$ amplify add api
? Please select from one of the below mentioned services: REST
? Provide a friendly name for your resource to be used as a label for this category in the project: rest
? Provide a path (e.g., /book/{isbn}): /items
? Choose a Lambda source Create a new Lambda function
? Provide an AWS Lambda function name: listPublic
? Choose the runtime that you want to use: NodeJS
? Choose the function template that you want to use: Hello World

Available advanced settings:
- Resource access permissions
- Scheduled recurring invocation
- Lambda layers configuration

? Do you want to configure advanced settings? Yes
? Do you want to access other resources in this project from your Lambda function? Yes
? Select the category storage
? Storage has 8 resources in this project. Select the one you would like your Lambda to access Public:@model(appsync)
? Select the operations you want to permit for Public:@model(appsync) create, read, update, delete

You can access the following resource attributes as environment variables from your Lambda function
        API_MYPROJECT_GRAPHQLAPIIDOUTPUT
        API_MYPROJECT_PUBLICTABLE_ARN
        API_MYPROJECT_PUBLICTABLE_NAME
        ENV
        REGION
? Do you want to invoke this function on a recurring schedule? No
? Do you want to configure Lambda layers for this function? No
? Do you want to edit the local lambda function now? No
Successfully added resource listPublic locally.

Next steps:
Check out sample function code generated in <project-dir>/amplify/backend/function/listPublic/src
"amplify function build" builds all of your functions currently in the project
"amplify mock function <functionName>" runs your function locally
"amplify push" builds all of your local backend resources and provisions them in the cloud
"amplify publish" builds all of your local backend and front-end resources (if you added hosting category) and provisions them in the cloud
Succesfully added the Lambda function locally
? Restrict API access No
? Do you want to add another path? No
Successfully added resource rest locally

4. Изменяю Lambda функцию

/* Amplify Params - DO NOT EDIT
    API_MYPROJECT_GRAPHQLAPIIDOUTPUT
    API_MYPROJECT_PUBLICTABLE_ARN
    API_MYPROJECT_PUBLICTABLE_NAME
    ENV
    REGION
Amplify Params - DO NOT EDIT */

const AWS = require("aws-sdk");
const region = process.env.REGION

AWS.config.update({ region });

const docClient = new AWS.DynamoDB.DocumentClient();

const params = {
    TableName: "PublicTable"
}

async function listItems(){
    try {
      const data = await docClient.scan(params).promise()
      return data
    } catch (err) {
      return err
    }
}

exports.handler = async (event) => {
    try {
        const data = await listItems()
        return { body: JSON.stringify(data) }
      } catch (err) {
        return { error: err }
    }
};

4. Пушу изменения

$ amplify push

5. Открываю мой REST API эндпоинт /items

{
  "message": "User: arn:aws:sts::829736458236:assumed-role/myprojectLambdaRolef4f571b-dev/listPublic-dev is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:us-east-1:8297345848236:table/Public-ssrh52tnjvcdrp5h7evy3zdldsd-dev",
  "code": "AccessDeniedException",
  "time": "2021-04-21T21:21:32.778Z",
  "requestId": "JOA5KO3GVS3QG7RQ2V824NGFVV4KQNSO5AEMVJF66Q9ASUAAJG",
  "statusCode": 400,
  "retryable": false,
  "retryDelay": 28.689093010346657
}

Проблемы

1. Что я делаю неправильно?
2. Как получить доступ к моей таблице и почему я его не получил сразу после создания функции?
3. Зачем нужны константы API_MYPROJECT_PUBLICTABLE_NAME и другие?