Reports

It appears that for gateway endpoints, the Principal element must be set to *. To specify the principal, you need to use the aws:PrincipalArn key like this:

"Condition": {
    "StringEquals": {
        "aws:PrincipalArn": "arn:aws:iam::1111111:role/lambdaRoleA"
    }
}

Just needed to add this inside of of the Statement at the same level as Resource.

Found the answer in the AWS documentation: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html

Tested it by added a different role initially - lambdaRoleB and the s3 object was not deleted. Later changed it to lambdaRoleA and the object was successfully deleted.

79387802