EventBridge rule matches but Lambda gets 403 on Genesys API

Docs state: “Ensure the Lambda execution role has permissions to invoke the API.” I have the role attached. Rule triggers fine. Lambda logs show 403 immediately on POST /api/v2/analytics/conversations/details/summary. Code is vanilla boto3. What am I missing?