amazon web services – Amplify / AppSync – GraphQL Schema Auth Rules

I would like some clarity on the schema auth rules in Amplify. I have the below schema.

input AMPLIFY {
  globalAuthRule: AuthRule = { allow: public }
} # FOR TESTING ONLY!
type Item
  @model
  @auth(
    rules: [
      { allow: owner, ownerField: "sub", operations: [create, update, delete] }
      { allow: private, operations: [read] }
      { allow: public, operations: [read] }
    ]
  ) {

It does not let an unauthenticated user access the API (‘No current user’ error when using nextjs getStaticProps which runs at the server level). I do not know why this is the case – given that I have specified { allow: public, operations: [read] } alongside the globalAuthRule.

I also don’t know ownerField is enforced, e.g. does AppSync link the cognito user’s ‘sub’ attribute to a request to create an item on dynamoDB?
The amplify docs are quite poor on this.