Is there a way to specify roles and policies of the lambdas in awsx API? Or are they locked down to the default full access roles?

You can use

aws.lambda.CallbackFunction

to create a lambda from a callback while also specifying your own roles/policies as well as other customization.