Architect Data Action calling Lambda: 403 Forbidden on Invoke

Architect & Flows
1

Trying to call a Lambda from a Genesys Cloud Architect Data Action. The flow hits the endpoint but returns a 403 Forbidden. I’ve added the lambda.invoke action to the role and attached it to the user running the flow. The IAM policy looks correct:

{
 "Effect": "Allow",
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-west-2:123456789:function:WfmSync"
}

Still getting blocked. Missing a resource condition or is this a Genesys side config issue?