title: Lambda function not authorized to perform apigateway:GET
body: <p>I'm trying to invoke a function with AWS-SDK from Gateway api but I receive the error below. </p>
  
  <p>The execution role has a policy with execute-api:* as action and resoure is '*'.</p>
  
  <p>And the code is: </p>
  
  <pre><code>const restApi = await new Promise((resolve, reject) =&gt; {
          apiGateway.getRestApi({restApiId: myRestApi}, function(err, data) {
  </code></pre>
  
  <p>The error:</p>
  
  <pre><code>2020-06-06T08:58:47.741Z    d3e08e04-095c-41ec-bbe6-69344d53854c    INFO    getRestApi err AccessDeniedException: User: arn:aws:sts::123412341234:assumed-role/mydev-LambdaExecutionRole/mydev-api-FooFunctionsStack-AddFooFunction-123ASDF is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:eu-west-1::/restapis/xxx111yy
      at Object.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:51:27)
      at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)
      at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
      at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
  </code></pre>
  
  <p>The network settings should be fine, lambda is within VPC but it has public subnet to connect services outside from it. Previously it didn't and the apiGateway.getRestApi was timed out. </p>
  
  <p>Role policy: </p>
  
  <pre><code>LambdaExecutionRole: 
      Type: AWS::IAM::Role
      Properties: 
        RoleName: 'MyRole'
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement: 
            - Effect: Allow
              Principal: 
                Service: 
                  - lambda.amazonaws.com
              Action: 
                - sts:AssumeRole
        Policies: 
          - PolicyName: lambda-execution-policy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: 
                    - secretsmanager:GetSecretValue
                    - rds:*
                    - rds-data:* 
                    - ses:SendEmail
                    - ses:SendRawEmail 
                    - ec2:DescribeNetworkInterfaces
                    - ec2:CreateNetworkInterface
                    - ec2:DeleteNetworkInterface
                    - s3:*
                    - execute-api:*
                  Resource: '*'
  </code></pre>