What part of the following cognito authorizer is incorrectly configured?

The following is my template.yaml configuration. For some reason, even without the proper credentials, my HelloWorldFunction still returns a response.

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: 

Globals:
    Api:
        Cors:
            AllowMethods: "'GET,POST,OPTIONS'"
            AllowHeaders: "'content-type'"
            AllowOrigin: "'http://127.0.0.1:8887'"
            AllowCredentials: true

Resources:
    HelloWorldApi:
        Type: AWS::Serverless::Api
        Properties:
            StageName: dev
            Auth:
                DefaultAuthorizer: MyCognitoAuthorizer
                Authorizers:
                    MyCognitoAuthorizer:
                        UserPoolArn: !GetAtt MyCognitoUserPool.Arn

    MyCognitoUserPool:
        Type: AWS::Cognito::UserPool
        Properties:
            UserPoolName: <pool name here>
            Policies:
                PasswordPolicy:
                    MinimumLength: 8
            UsernameAttributes:
                - email
            Schema:
                - AttributeDataType: String
                  Name: email
                  Required: false

    MyCognitoUserPoolClient:
        Type: AWS::Cognito::UserPoolClient
        Properties:
            UserPoolId: !Ref MyCognitoUserPool
            ClientName: <client name here>
            GenerateSecret: false

    HelloWorldFunction:
        Type: AWS::Serverless::Function
        Properties:
            CodeUri: ./
            Handler: index.helloWorldHandler
            Runtime: nodejs14.x
            Events:
                ApiEvent:
                    Type: Api
                    Properties:
                        Path: /hello
                        Method: get
                        RestApiId: !Ref HelloWorldApi

    LabUIAuth:
        Type: AWS::Serverless::Function
        Properties:
            Timeout: 100
            CodeUri: ./
            Handler: index.authHandler
            Runtime: nodejs14.x
            Events:
                CreateUser:
                    Type: Api
                    Properties:
                        Path: /auth/create-user
                        Method: post
                ConfirmUser:
                    Type: Api
                    Properties:
                        Path: /auth/confirm-user
                        Method: post
                Login:
                    Type: Api
                    Properties:
                        Path: /auth/login
                        Method: post
                Refresh:
                    Type: Api
                    Properties:
                        Path: /auth/refresh
                        Method: get

I followed the AWS documentation as best I could, but my endpoint remains open. I added the UserPool and UserPoolClient with correct references and names, but it doesn't look like anything is happening. What do I need to change to protect my endpoint?