AWS Cognito - how to determine if unauthenticated user?

I have AWS Lambda functions working fine with Cognito authenticated users.

I am now trying to get unauthenticated Cognito users going.

I cannot find any way at the back end to determine if the current user that called the Lambda function is authenticated or unauthenticated.

The identifying information that I have about the user is their Cognito IdentityId but how can I use that to find out of unauthenticated?

I'm using Python boto3.6 in Lambda.