403 Forbidden on Architect Data Action calling Lambda

Architect & Flows
1

I’m trying to trigger an AWS Lambda from a Genesys Architect Data Action using the REST endpoint. The IAM role has the lambda:InvokeFunction permission, but the response is a 403 Forbidden. Here’s the Terraform config for the role:

resource "aws_iam_role_policy" "invoke_lambda" {
 role = aws_iam_role.cxone_lambda_role.name
 policy = jsonencode({
 Version = "2012-10-17"
 Statement = [
 {
 Effect = "Allow"
 Action = "lambda:InvokeFunction"
 Resource = aws_lambda_function.handler.arn
 }
 ]
 })
}

The Lambda is public. What am I missing?