Serverless Stack

I'm going though the identity pool section of the walkthough and trying to grant the identity pool authenticated role permissions to talk to to api gateway:
<https://serverless-stack.com/chapters/configure-cognito-identity-pool-in-cdk.html>

Previously in serverless.yaml I had
``` - Effect: 'Allow'
   Action:
     - 'execute-api:Invoke'
   Resource:
     Fn::Join:
       - ''
       - - 'arn:aws:execute-api:'
         - Ref: AWS::Region
         - ':'
         - Ref: AWS::AccountId
         - ':'
         - Ref: ApiGatewayRestApi
         - '/*'```
What would be the equivalent in cdk given I have a `api = new sst.Api`
```this.role.addToPolicy(
  new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['execute-api:Invoke'],
    resources: [api.httpApi.???],
  }),
)```


```const resourceArn = Stack.of(this).formatArn({
  service: "execute-api",
  resourceName: `*`,
  resource: api.httpApi.httpApiId,
});```
and then
```resources: [resourceArn],```

Alternatively, if you are using `sst.Auth` to create the Identity Pool, you can just do:
```const auth = sst.Auth(...);
auth.attachPermissionsForAuthUsers([api]);```

The guide is a bit out dated, <@U01J5Q8HV5Z> is going to update them to use new SST constructs.