I'm having issues using the EC2 SDK from a lambda that Pulumi has created via

aws.cloudwatch.onSchedule()

. I can run

console.log

inside the eventhandler code and I can see the output in my cloudwatch log. But the

console.log

code I have inside my

ec2Client.describeInstances()

callback is not appearing in cloudwatch; I don't know if it's because the callback isn't being called, or if there's insufficient permissions. How should I investigate? Where would (for example) permission errors show up?