Lambda Data Action 403: IAM Role missing permissions for OTel context?

Architect & Flows
1

I’m trying to propagate OpenTelemetry trace context from a Genesys Cloud Architect flow into an AWS Lambda via a Data Action call. The setup seems correct on the Architect side, but the Lambda invocation keeps failing with a 403 Forbidden. Here is the relevant IAM policy attached to the execution role:

{
 "Effect": "Allow",
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-east-1:123456789:function:otel-tracer"
}

The error response from the Data Action is just status: 403, message: User: arn:aws:sts::123456789:assumed-role/gc-lambda-role/i-0123456 is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-1:123456789:function:otel-tracer. I’ve confirmed the ARN matches exactly. Is there a specific permission boundary or trust policy requirement I’m missing when calling Lambda from Genesys Cloud? The trace context injection works fine for HTTP endpoints, so I suspect it’s strictly an IAM issue. Just need to get the span started before the Lambda processes the data.

2

The policy you posted only allows invoking the function, it doesn’t grant the permissions needed to write metrics or logs if your Lambda is trying to do that on startup. Check the CloudWatch logs for the specific “AccessDenied” error, because the 403 usually means the role can call the function but the function itself is failing an internal permission check.