How to write policies for multiple custom authorizers in one API Gateway REST API?

tl;dr How do I write a policy and/or structure my resource when using multiple custom authorizers in one REST API?

I have a REST API in API Gateway with multiple resources. For some of them any requests should be allowed so long as they have a special header with a secret value (i.e. there is no user auth). For others, the requests both need the special header and an user auth.

The special header works like an API key, but can't be x-api-key since I don't control the header, nor its value.

• /resource1 – X-HEADER (allow any user)
• /resource2 – X-HEADER (allow any user)
• /resource3 – X-HEADER and Auth (only allow signed-in users)
• /resource4 – X-HEADER and Auth (only allow signed-in users)

To solve this I have two custom authorizers. For PublicAuthorizer I use header X-HEADER as the identity source, for LoggedInAuthorizer I user headers X-HEADER and Auth as the identity source. (The authorizers are of type REQUEST.)

So far so good. The problem is how to write the policies. This is the current response from LoggedInAuthorizer:

{
  "principalId": "[the user id]",
  "policyDocument": {
    "Version": "2012-10-17",
    "Statement": [{
      "Resource": "arn:aws:execute-api:[region]:[account id]:[rest api id]/[stage]*",
      "Action": "execute-api:Invoke",
      "Effect": "Allow"
    }]
  }
}

This is the current response from PublicAuthorizer (always using the same principalId):

{
  "principalId": "anonymous user",
  "policyDocument": {
    "Version": "2012-10-17",
    "Statement": [{
      "Resource": "arn:aws:execute-api:[region]:[account id]:[rest api id]/[stage]*",
      "Action": "execute-api:Invoke",
      "Effect": "Allow"
    }]
  }
}

This works but I'm concerned about using the same Resource for both policies.

Is there a risk that an attacker can make a request to /resource1 and then to /resource3 and reuse the first policy to call gain access without having user authentication? (I've tried but failed to do it)

I've enabled Authorization Caching so I can't use event.methodArn as Resource. Doing that prevents the user from calling any other resources during the cache period.

Do I have to change the structure of my resources so that the policy use path prefix to cover a subset of the resource? For instance "arn:aws:execute-api:[region]:[account id]:[rest api id]/[stage]/*/public/*" for this structure:

• /public/resource1 – X-HEADER
• /public/resource2 – X-HEADER
• /private/resource3 – X-HEADER and Auth
• /private/resource4 – X-HEADER and Auth