ok, figured ☝️ out (you need to allow elb to invoke the function in the _function_'s role), but now it doesn't like the new

RolePolicy