I\'m struggling to understand the practical differences between an execution role that can be assumed by API gateway to grant the permission to execute a lambda over a lambd