A web application uses Amazon API Gateway with a Lambda function and DynamoDB, secured by Amazon Cognito. How to restrict premium content access to only subscribed users with minimal operational overhead?