How can you create an IAM policy with execute-api:Invoke action for the API endpoint created by Serverless

Serverless Framework
1

Suppose I want to create a policy that gives the execute-api:Invoke action permission to a role. What do I put as the {?} in order to reference the API created by serverless deploy :

          - PolicyName: invoke-api-gateway
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - Ref: {?}
2

This seems to work:

Resource: { "Fn::Join" : ["", ["arn:aws:execute-api:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":",{"Ref":"ApiGatewayRestApi"},"/*"]]}