title: AWS anonymous is not authorized to perform: execute-api:Invoke on resource. Private API Gateway
body: <p>I have a REST API Lambda function deployed to a private subnet, where the API Gateway type is private. Following <a href="https://aws.amazon.com/de/blogs/compute/introducing-amazon-api-gateway-private-endpoints/" rel="nofollow noreferrer">this</a> I have set up a vpc endpoint to private API gateway to the two public subnets of the same vpc as the lambda functions private subnet. The corresponding security group of the vpce allows all traffic.</p>
  
  <p>If I try to query the API endpoint from an EC2 instance in the public subnet, I get the following error:</p>
  
  <pre><code> anonymous is not authorized to perform: execute-api:Invoke on the resource.
  </code></pre>
  
  <p>I cannot find the issue, as the resource policy of the private API gateway looks as follows:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "execute-api:Invoke",
              "Resource": "arn:aws:execute-api:eu-central-1:xxxxxxx:xxxxxx/*",
              "Condition": {
                  "StringEquals": {
                      "aws:sourceVpce": "vpce-xxxxxxxx"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>What am I missing?</p>