AppSync Unauthorized Error When Called From PreSignUp Lambda Trigger

Hello Everyone,

I'm using AWS Amplify for provisioning resources via the CLI, and CI/CD. I have a presignup lambda trigger and a postconfirmation lambda trigger on my cognito pool. The presignup trigger calls my AppSync GraphQL API to create a User object in Dynamo. The postconfirm trigger makes the same call to update the User's status to confirmed in Dynamo.

I currently have this deployed in my dev environment. The PostConfirm trigger is working perfectly fine, but the PreSignUp trigger is throwing an unauthorized error:

"errors": [
        {
            "path": [
                "createUser"
            ],
            "data": null,
            "errorType": "Unauthorized",
            "errorInfo": null,
            "locations": [
                {
                    "line": 3,
                    "column": 7,
                    "sourceName": null
                }
            ],
            "message": "Not Authorized to access createUser on type Mutation"
        }
    ]

This is very strange to me as both Lambdas have access to the same resource: arn:aws:appsync:us-west-2:XXXXXXX:apis/XXXXXXXX/types/Mutation/*

To troubleshoot I set the execution role of the PreSignUp trigger to the same execution role as the PostConfirmation trigger and that worked. This is a temporary fix for dev as I need the PreSignUp trigger to use it's respective role set by the Amplify CLI. I've looked at both roles in IAM and cannot see a single difference amongst policies.