A new Lambda for building-permit webhooks fails because it cannot assume its execution role. The role’s trust policy does not allow the Lambda service. What should be fixed?
Select an answer to reveal the explanation.
Short Explanation
An execution role without lambda.amazonaws.com in the trust policy is a locked door with the right keyring on the wrong hook. Fix the trust relationship so Lambda can assume the role. Runtime swaps and keys in code do not repair trust.
Full Explanation
IAM roles used as Lambda execution roles must trust the Lambda service principal (lambda.amazonaws.com). Without that trust policy statement, Lambda cannot assume the role regardless of identity-based permissions attached to it. Embedding access keys in code bypasses the intended model. Changing runtimes does not remove the trust requirement.