Architect Data Action calling Lambda - 403 Forbidden IAM issue

Trying to hit an AWS Lambda from a Genesys Architect flow. Getting a 403 Forbidden. Here’s the Data Action JSON:

{
 "name": "Call Lambda",
 "url": "https://lambda.us-east-1.amazonaws.com/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789/function/myFunc/invocations"
}

The Lambda role has lambda:InvokeFunction. Is the IAM policy on the Lambda side wrong, or does the Data Action need headers? Not seeing docs for this.