Access DynamoDB from Fargate container in private subnets

I'm building the following infrastructure for my project that uses FastAPI for API designs. There are two microservices here: /user/* and /admin/*, that reads and updates data stored in the DynamoDB.

The setup is the following: I have a VPC with 2 AZs, each hosting a public and a private subnet. Each public subnet has a NAT Gateway for the private subnet in the same AZ. A Internet Gateway is attached to the VPC. A VPC endpoint for DynamoDB is created. ECS cluster is created with Fargate being the launch type, and the service is running in two private subnets.

The CloudFormation template builds but the API request returns internal server error. I believe the problem is the container doesn't have proper access to the DynamoDB table.

The following is the IAM role I created and attached to the ECS container (ECSTaskExecutionRole):

ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    # Role for ECS task
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      Policies:
        - PolicyName: AmznECSTaskExecutionRolePolicy
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
                # ECS tasks to download images from ECR
                - ecr:GetAuthorizationToken
                - ecr:BatchCheckLayerAvailability
                - ecr:GetDownloadUrlForLayer
                - ecr:BatchGetImage
                # ECS tasks to upload logs to CloudWatch
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
                - logs:DescribeLogStreams
                # ECS tasks to use DynamoDB
                - dynamodb:Batch*
                - dynamodb:Delete*
                - dynamodb:DescribeTable
                - dynamodb:GetItem
                - dynamodb:PutItem
                - dynamodb:Update*
              Resource: '*'

And the following is the VPC endpoint for DynamoDB:

DynamoDBVpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.dynamodb"
      VpcEndpointType: Gateway
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: '*'
            Principal: '*'
            Resource: '*'
      RouteTableIds:
        - !Ref VPCPrivateRouteTable1
        - !Ref VPCPrivateRouteTable2

I've also made sure that the route table for the private subnets contain a pair for DynamoDB endpoint.

Any help would be greatly appreciated! Thank you.