flutter dart appsync AMAZON_COGNITO_USER_POOLS access

app.dart

    var tokens = await _identityRepository.tokens;
    var graphqlEndpoint = "https://xxxxxxxxxxxxxxxxxxxxxxxxxx.appsync-api.us-east-1.amazonaws.com";
    var graphqlQuery = """
      query listPets {
        listPets {
          id
          price
          type
        }
      }
    """;

    var graphqlApi = GraphQLApi(graphqlEndpoint, 'us-east-1');
    await graphqlApi.post(token.accessToken, graphqlQuery);

graphql_api.dart

import 'dart:convert';

import 'package:http/http.dart' as http;

class GraphQLApi {
  final String endpoint;
  final String region;

  GraphQLApi(this.endpoint, this.region);

  Future<dynamic> post(String accessToken, String query) async {
    http.Response response;
    try {
      response = await http.post("$endpoint/graphql",
          headers: {
            "Authorization": accessToken,
            "Content-Type": "application/json; charset=utf-8"
          },
          body: json.encode({"operationName": "listPets", "query": query}));
    } catch (e) {
      print(e);
    }
    print(response.body);
    return response.body;
  }
}

index.js

const graphQLApiCloudWatchLogsRole = new aws.iam.Role("graphQLApiCloudWatchLogsRole", {
    assumeRolePolicy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Service": "appsync.amazonaws.com"
                },
                "Action": "sts:AssumeRole"
            }
        ]
    }),
});

const graphQLApiCloudWatchLogsRolePolicyAttachment = new aws.iam.RolePolicyAttachment("graphQLApiCloudWatchLogsRolePolicyAttachment", {
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
    role: graphQLApiCloudWatchLogsRole.name,
});

const graphQLApi = new aws.appsync.GraphQLApi("graphQLApi", {
    authenticationType: "AMAZON_COGNITO_USER_POOLS",
    logConfig: {
        cloudwatchLogsRoleArn: graphQLApiCloudWatchLogsRole.arn,
        fieldLogLevel: "ERROR",
    },
    userPoolConfig: {
        awsRegion: "us-east-1",
        defaultAction: "DENY", // "DENY" forces you to use @aws_auth(cognito_groups: ["Bloggers"]) in the schema
        userPoolId: userPool.id,
    },
    schema: graphQLSchema,
});