Appsync emulator - setting defaultAction: DENY has no effect

[mattgibson]

I want to build an API which is not public and which requires a cognito user pool token for access. I have set defaultAction: DENY in serverless.yml, but there is nothing blocking access when I make a request, provided the JWT I supply in the auth header is actually a JWT. It doesn't fail if the JWT has got nothing to do with the user pool I specified, whereas the actual deployed API refuses access.

[cbaron]

@mattgibson -- thanks for flagging this.