should I create Public api based on the current internal api

My project is having public website and Content Management System(CMS).
I am using Lambda and API Gateway for the api.
The CMS currently has an api GET request to get ALL the data from the table below.

“Banner” Table

attribute:
-id: string(primary key/partition key)
-title: string
-isActive: boolean
...

-----------------------------------------------
Id    isActive    title
1    true        title1
2    false        title2
3    true        title3
4    true        title4
----------------------------------------------

This is My lambda function:
getBanner.js

'use strict'
const AWS = require('aws-sdk');

exports.handler = async function (event, context, callback) {
    const documentClient = new AWS.DynamoDB.DocumentClient();

    let responseBody = "";
    let statusCode = 0;

    const params = {
        TableName : "Banner",
    };

    try{
        const data = await documentClient.scan(params).promise();
        responseBody = JSON.stringify(data.Items);
        statusCode = 200
    }catch(err){
        statusCode = 403
    }

    const response = {
        statusCode: statusCode,
        body: responseBody
    }

    return response
}

I need an api to get all banners with isActive = true.

There are 2 approaches I can think of

1.Modify the existing lambda function

I can add something like below:

…
if(event.queryStringParameters.isActive === true){
     // add filter or query to get all result
}
...

But everyone is able to get all the data(including the results with isActive = false) if they do not use the queryStringParameters,
which is what I want to avoid since the data with isActive = false should not be seen by the public.

2.Create new lambda function

This is probably the best way to protect the data.
But I have a lot of API encountering the same situation(having “inActive” attribute), it means I need to create a lot of public api.
Which method should I use?