How to enable public query appsync amplify - reactjs

Question

I am using AWS Amplify with Appsync. I want to add a public query listproducts and it is giving me the hardest time. Based on my understanding, I know that public access needs to be given using apiKey or iam. The trouble is that my mutation enroll lambda function internally makes a create mutation and it is using iam permissions to create those records. I have enabled allowUnauthenticatedIdentities=true but I keep getting access denied for the listproducts query when using iam permissions. I need to make sure that if I go with the iam method, that I have a way to distinguish between the public iam and the private iam that is doing the administrative work in my enroll call and I don't see a way to dictate whether I'd want to use an authenticated vs unauthenticated iam role.
type Product #aws_iam {
id: ID!
}
type UserCourse
#model
#auth(
rules: [
{ allow: groups, groups: ["Admin"] }
{ allow: owner, operations: [read] }
{ allow: private, provider: iam, operations: [create, read] }
]
) {
id: ID!
courseId: String
invoice: String
}
type Query {
listproducts: [Product]
#function(name: "listproducts-${env}")
#auth(rules: [{ allow: public, provider: iam }])
}
type Mutation {
enroll(courseId: String, priceId: String, source: String): UserCourse
#function(name: "coursesenroll-${env}")
}
What am I missing here? I am connecting using Gatsby and AWSAppSyncClient. Is there some trivial way of doing this that I'm just missing? My ideal world would be that I could run an unauthenticated query with cognito pools and it would return so I didn't have to deal with instantiating different appsyncclient's based on whether I'm logged in or not. I tried manually adding permissions to the unauth role and I'm not sure if that's the right approach but I'd be happy to go this route too if I can't do unauth out of the box with amplify.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"appsync:GraphQL"
],
"Resource": [
"arn:aws:appsync:eu-central-1:SOME_LONG_STRING:apis/SOME_LONG_STRING/types/Query/fields/listproducts"
]
}
]
}