Architect Data Action calling AWS Lambda - IAM Role 403 Access Denied

Architect & Flows
1

Hey folks,

I’m trying to trigger an AWS Lambda function from a Genesys Cloud Architect Data Action for a WFM adherence check. I’ve got the endpoint and payload set up, but I keep hitting a 403 error on the invoke.

Here’s the JSON error I get back:

{
 "message": "User: arn:aws:iam::123456789:role/wfm-lambda-role is not authorized to perform: lambda:InvokeFunction"
}

The role definitely has the lambda:InvokeFunction permission attached. Am I missing a resource ARN constraint or something else in the trust policy? I’ve checked the basic settings but it’s still failing.