Extend permission for auth/unauth users

I would like to see a way to extend the permission that provides to the auth/unauth users.
amplify update and extend the role policies when added new category(e.g. storage) but how should I provide policies to that role that are managed outside the scope of amplify-cli for example - access to external API gateway execute-API, backend Serverless REST api that has it's own repo and lifecycle.

the solution should be supported by amplify multi env. we also using multi aws account per env/developer. currently, the only workaround we found is to provide admin for all the arn's cross accounts
`arn:aws:execute-api:*:*:*`

** Which Category is your question related to? **
Auth

** What AWS Services are you utilizing? **
Many of aws resources that outside amplify-cli scope

** Provide additional details e.g. code snippets **

The issue concerns Amplify CLI Auth role policies and permissions for external AWS API Gateway resources. Start by tracing how amplify update manages Auth policies, then determine how externally managed execute-api permissions could work across Amplify multi-env and multi-account setups. Done means a documented, supported approach exists without granting broad administrator access.

Written by the indexing model from the issue text.