Use Cognito group with attached IAM role with API Gateway

I'm attempting to utilize groups in Cognito with attached IAM roles / policies to control access to resources in my API Gateway, but I'm fairly new to the whole concept and am struggling to piece it all together. I have a user group with an attached role. When setting up the role, I selected Web Identity, chose Cognito as the provider, entered my Cognito User Pool Id, and attached the following policy: (once/if I get it working I will restrict the policy more!)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "execute-api:*",
            "Resource": "*"
        }
    ]
}

Then on my resource in API Gateway, I selected my resource method, and in the Method Request I selected AWS IAM as the auth method.

My understanding is, the user will authenticate with Cognito and receive their id/access tokens. Then, they will include a token in the Authorization header when making a request to the API Gateway endpoint. API Gateway will validate the user with Cognito, see there is a role attached to the user via the group(s). API Gateway will then check the policy attached to the role now assumed by the user, at which point it should pass the AWS IAM authorization since the policy allows it.

However, no matter what changes I make, I get a 403 when making a request to the API Gateway endpoint. I am using AWS amplify with the aws-amplify npm package, so my request looks like this in the frontend

const result = await API.get("myApi", "/clc", {
      headers: {
        Authorization: `${idToken}`,
      },
    });

I am using the idToken because that's where the cognito:roles attribute is, but I have also tried with the accessToken, yet both result in a 403 with the following message Authorization header requires 'Credential' parameter. Authorization header requires 'Signature' parameter. Authorization header requires 'SignedHeaders' parameter. ...

If I remove the AWS IAM authorization from the endpoint, it returns a 200. I know my understanding is fundamentally flawed somewhere, but I've been digging through AWS docs for days and can't understand. I am also partially basing this off an answer I found on SO here. I can provide any additional information necessary that I've neglected to include, just let me know!