title: AccessDenied on DynamoDB GSI Index
body: <p>I've wrote a <code>serverless.yml</code> to deploy some lambdas and I'm using GSI in a specific API.</p>
  
  <p>If I run locally using serverless-offline, it's working but I'm facing an error when deploy the lambda:</p>
  
  <pre><code>AccessDeniedException: User: arn:aws:sts::408462944160:assumed-role/telecom-integration-dev-us-east-1-lambdaRole/integration-dev-dialerStatistics 
  is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:408462944160:table/integration-dialer-dev/index/other_dial_status-index
  </code></pre>
  
  <p>Here is how I've created serverless.yml</p>
  
  <pre><code> iamRoleStatements:
     - Effect: Allow
       Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem 
      Resource:        
      - { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }
  
  
  dialerStatistics:
    handler: integration/dialer.statistics
    description: Import data on dialer.
    memorySize: 256
    timeout: 30
    events:
      - http:
          path: dialer-statistics
          method: get
          cors: false
          private: false  
  
  
  DialerDynamoDbTable:
    Type: 'AWS::DynamoDB::Table'
    DeletionPolicy: ${self:provider.environment.DELETION_POLICY}
    # DeletionPolicy: Delete # Useful for recreating environment in dev
    Properties:
      AttributeDefinitions:
        -
          AttributeName: "id"
          AttributeType: "S"
        -
          AttributeName: "dial_status"
          AttributeType: "S"
      KeySchema:
        -
          AttributeName: "id"
          KeyType: "HASH"
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      TableName: ${self:provider.environment.DIALER_TABLE}  
      GlobalSecondaryIndexes:
      - IndexName: "other_dial_status-index"
        KeySchema:
        - AttributeName: "dial_status"
          KeyType: HASH
        Projection:
          ProjectionType: "ALL"
        ProvisionedThroughput:
          ReadCapacityUnits: '20'
          WriteCapacityUnits: '20'
  </code></pre>
  
  <p>Probably it's missing some permission on iAmRoleStatements but I'm not sure what else should I do.</p>