ok, trying to define a lambda-based application load balancer, and i'm getting

Error registering targets with target group: AccessDenied: elasticloadbalancing principal does not have permission to invoke arn:aws:lambda:us-east-2:012949464119:function:SpamService-function-38d5231 from target group arn:aws:elasticloadbalancing:us-east-2:012949464119:targetgroup/SpamService-target-6d47bc1/b974b8af06bf99ea

which reads like an IAM role missing/misconfiguration, but there's no place to configure it. I also created one by hand, and it works, and it didn't create a role.