Thanks, adding 'assuming-role' Principal in the 'NotPrincipal' did the trick.
Strangely, there is not mention of this in the AWS documentation (atleast it is not out there)

Thank you! it seems that the assumed-role ARN is different. Do you have any idea how to find the assumed role ARN for the lambda?

It should have the form "arn:aws:sts::123456789012:assumed-role/my-lambda-role/my-lambda-function", where "123456789012" is your account number, "my-lambda-role" the name of the role your lambda function is assigned to, and "my-lambda-function" your function name.

Thanks a lot!