[Feedback]"Calling GraphQL API from a Lambda function" does not indicate how widely it opens permissions

**Page**: [`/guides/functions/graphql-from-lambda/q/platform/[platform]`](https://docs.amplify.aws/guides/functions/graphql-from-lambda/q/platform/js)

**Feedback**:

In the section "IAM Authorization", it suggests adding an auth rule like: `{ allow: private, provider: iam }`
And says "The CLI will automatically configure the Lambda execution IAM role to call the GraphQL API".

First, this statement is incorrect. Adding this auth rule in schema.graphql updates the "authRole" role that is used by identity pool. But it does not modify the execution role for the lambda (which is what applies when following these instructions) -- that role is modified by running `amplify function update` and granting access to the API.

Second (the bigger problem): Devs come to this page trying to only grant access for their lambda to call the API. However, despite the name "private", the rule `{ allow: private, provider: iam }` actually makes the data **public** to any logged-in user (as documented [here](https://docs.amplify.aws/cli/graphql/authorization-rules/#authorization-strategies)).
If, for example, they use user pools to restrict access to only the owner (`{ allow: owner }`), then if they follow this page and add the iam rule, they will have effectively eliminated the owner protection on that entity. There is no recommended way for a graphql auth rule to grant access only to a trusted IAM caller such as a lambda.

I wrote up the workaround I used [here](https://stackoverflow.com/a/76780865/342647) -- using `amplify override auth` to replace the authRole with an empty dummy role.