Architect Data Action 403 invoking Lambda despite correct IAM policy

Trying to trigger an AWS Lambda from a Genesys Cloud Architect Data Action via HTTPS. The Data Action is configured with the Lambda URL and headers, but it keeps returning a 403 Forbidden response.

The IAM policy attached to the Lambda role looks standard enough. We’ve verified the ARN and the permissions.

{
 "Effect": "Allow",
 "Action": "lambda:InvokeFunctionUrl",
 "Resource": "arn:aws:lambda:eu-west-1:123456789:function:my-cx-handler"
}

The endpoint URL is correct. Still getting blocked.