Restrict lambda resolver to owner for GraphQL API using Amplify

In my schema.graphql file I have the following:

type Floorplan @model @auth(rules: [
        { allow: private, operations: [read], provider: userPools },
        { allow: owner, provider: userPools }
    ]) @aws_cognito_user_pools {
    id: ID! @primaryKey
    name: String!
    bedrooms: Int!
}

input FloorplanInput {
    id: ID!
    name: String!
    bedrooms: Int!
}

type Mutation {
    floorplanLambda(input: FloorplanInput): Floorplan 
    @function(name: "floorplanLambda-${env}")
    @aws_cognito_user_pools
}

I created the lambda function to perform custom validation before updating. The problem is that any authenticated user can update other users' floor plans. I thought adding @aws_cognito_user_pools would resolve this, but it doesn't.

Question: What do I need to add to lock down the floorplanLambda function so that it can only be successfully called by the owner of the Floorplan model?

When calling floorplanLambda I receive the error: "Not Authorized to access floorplanLambda on type Floorplan". I'm making the call with authMode AMAZON_COGNITO_USER_POOLS.

For some more context, I followed this tutorial to create the custom mutation lambda function: https://www.theclouddeveloper.io/use-lambda-resolvers-in-your-graph-ql-api-with-aws-amplify