title: CognitoIdentityCredentials is not authorized to perform: lambda:InvokeFunction on resource
body: <p>I am trying to invoke a lambda function from an iOS client. My code looks like this:</p>
  
  <p>To get credentials, in appDelegate:</p>
  
  <pre><code>func application(_ application: UIApplication,
                   didFinishLaunchingWithOptions launchOptions:
  
      [UIApplicationLaunchOptionsKey: Any]?) -&gt; Bool {
  
  
      // Uncomment to turn on logging, look for "Welcome to AWS!" to confirm success
      AWSDDLog.add(AWSDDTTYLogger.sharedInstance)
      AWSDDLog.sharedInstance.logLevel = .error
  
  
      // Instantiate AWSMobileClient to get AWS user credentials
      return AWSMobileClient.sharedInstance().interceptApplication(application, didFinishLaunchingWithOptions: launchOptions)
  
  }
  </code></pre>
  
  <p>And to invoke on the viewController:</p>
  
  <pre><code>class ViewController: UIViewController {
  let lambdaInvoker = AWSLambdaInvoker.default()
  let jsonObject: [String: Any] = ["key1" : "value1",
                                   "key2" : 2 ,
                                   "key3" : [1, 2],
                                   "isError" : false]
  
  @IBAction func button(_ sender: Any) {
      print("pressed")
      lambdaInvoker.invokeFunction("myTest", jsonObject: jsonObject)
          .continueWith(block: {(task:AWSTask&lt;AnyObject&gt;) -&gt; Any? in
              if( task.error != nil) {
                  print("Error: \(task.error!)")
                  return nil
              }
  
              // Handle response in task.result
              if let JSONDictionary = task.result as? NSDictionary {
                  print("Result: \(JSONDictionary)")
                  print("resultKey: \(JSONDictionary["resultKey"])")
              }
              return nil
          })
  }
  </code></pre>
  
  <p>It throws this error:</p>
  
  <pre><code>... Message=User: arn:aws:sts::103314601078:assumed-role/Cognito_testpoolUnauth_Role/CognitoIdentityCredentials is not authorized to perform: lambda:InvokeFunction on resource ...
  </code></pre>
  
  <p>I also have this role set up:</p>
  
  <pre><code>{
  "roleName": "myRoleTest",
    "policies": [
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "Stmt1464440182000",
              "Effect": "Allow",
              "Action": [
                "lambda:InvokeAsync",
                "lambda:InvokeFunction"
              ],
              "Resource": [
                "*"
              ]
            }
          ]
        }
  </code></pre>
  
  <p>I know I need to add permissions for that resource to invoke the function, but I can't find where or how to do it! I'd appreciate any help...</p>