Lambda Data Action returning 403 InvalidSignature despite correct IAM policy

Trying to invoke a Lambda function from an Architect Data Action. The integration is set up, but I keep getting a 403 with InvalidSignature. I’ve verified the IAM role has lambda:InvokeFunction and logs:CreateLogGroup. The Data Action JSON looks correct:

{
 "integrationId": "abc-123",
 "body": { "input": "test" }
}

Checked the Lambda logs; it’s not even receiving the request. Is there a specific trust policy requirement for the role that I’m missing?