ARN for Query on DynamoDB index not working

Serverless Framework
,
1

I want to query an index in a DynamoDB table. When doing so I get the following error:

User: arn:aws:sts::XXX:assumed-role/bifr-dev-us-east-1-lambdaRole/bifr-dev-login is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:XXX:table/customers/index/email_index

After trying to fix it with the proposed configs in https://stackoverflow.com/questions/51537795/accessdenied-on-dynamodb-gsi-index and AWS and DynamoDB permissions: "User is not authorized to access this resource" I came to the follwoing config, that still does not work. The same error persist. Maybe someone could help me with solving this problem.

Table config:

resources: 
      Resources:
        customers: 
          Type: AWS::DynamoDB::Table
          Properties:
            TableName: customers
            AttributeDefinitions:
              - AttributeName: "id"
                AttributeType: S
              - AttributeName: "email"
                AttributeType: S
            KeySchema:
              - AttributeName: "id"
                KeyType: HASH
            BillingMode: PAY_PER_REQUEST
            GlobalSecondaryIndexes: 
            - IndexName: 'email_index'
              KeySchema:
              - AttributeName: 'email'
                KeyType: 'HASH'
              Projection: 
                ProjectionType: 'ALL'

IAM Role config:

iamRoleStatements:
- Effect: Allow
  Action:
    - dynamodb:GetItem
    - dynamodb:UpdateItem
    - dynamodb:PutItem
    - dynamodb:Scan
  Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/*"
- Effect: Allow
  Action:
    - dynamodb:Query
  Resource: "arn:aws:dynamodb:us-east-1:250781267785:table/customers/index/email_index"

NodeJS code for the query:

var res = await aws.QueryItems({
    TableName: tableName,

    IndexName: 'email_index',
    KeyConditionExpression: '#email = :email',
    ExpressionAttributeNames: {
        "#email": "email"
    },
    ExpressionAttributeValues: {
        ":email": email
    }
});
2

If your lambda is in a VPC (uses private Subnet) and DynamoDB is not in the same VPC,
chances are you won’t be able to connect both unless you establish VPC Peering