looking at the end of https://docs.aws.amazon.com/lambda/latest/dg/services-alb.html it gives an awscli command to call to allow elb to invoke your lambda function, and it spits out an IAM policy