… (message deleted)

You may be missing the

assumeRolePolicy

property on the role itself. When you create the Role does it have something like this?

return new aws.iam.Role( 'sqs-to-ddb-role', {
		assumeRolePolicy: {
			Version: '2012-10-17',
			Statement: [
				{
					Effect: 'Allow',
					Principal: {
						Service: '<http://lambda.amazonaws.com|lambda.amazonaws.com>',
					},
					Action: 'sts:AssumeRole',
				},
			],
		},

Without giving lambda the ability to use sts, it cannot get tokens vended to call the Queue so though the Policy has all the requisite permissions, the role itself is trying to make the call without access keys, essentially.

yup, I have that too 😞

// Create the IAM policy for the function.
		roleArgs := &iam.RoleArgs{
			AssumeRolePolicy: pulumi.String(`{
				"Version": "2012-10-17",
				"Statement": [
				{
					"Action": "sts:AssumeRole",
					"Principal": {
						"Service": "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
					},
					"Effect": "Allow",
					"Sid": ""
				}
				]
			}`),
			Description: pulumi.String("Role for the Payment Service of the ACME Serverless Fitness Shop"),
			Tags:        pulumi.Map(tagMap),
		}

Why did you delete the original question? 🤔