fix: replace LambdaInvokePolicy with explicit IAM statement for EvaluationFunctionArn

Bob Strahan · Bob Strahan · commit cfa78ec8d129 · 2025-10-24T18:24:26.000Z
diff --git a/patterns/pattern-1/template.yaml b/patterns/pattern-1/template.yaml
@@ -680,8 +680,10 @@ Resources:
             FunctionName: !Ref HITLWaitFunction
         - LambdaInvokePolicy:
             FunctionName: !Ref HITLStatusUpdateFunction
-        - LambdaInvokePolicy:
-            FunctionName: !Ref EvaluationFunctionArn
+        - Statement:
+            - Effect: Allow
+              Action: lambda:InvokeFunction
+              Resource: !Ref EvaluationFunctionArn
         - CloudWatchLogsFullAccess
 
   StateMachineLogGroup:
diff --git a/patterns/pattern-2/template.yaml b/patterns/pattern-2/template.yaml
@@ -2365,8 +2365,10 @@ Resources:
             FunctionName: !Ref HITLStatusUpdateFunction
         - LambdaInvokePolicy:
             FunctionName: !Ref SummarizationFunction
-        - LambdaInvokePolicy:
-            FunctionName: !Ref EvaluationFunctionArn
+        - Statement:
+            - Effect: Allow
+              Action: lambda:InvokeFunction
+              Resource: !Ref EvaluationFunctionArn
         - CloudWatchLogsFullAccess
 
   StateMachineLogGroup:
diff --git a/patterns/pattern-3/template.yaml b/patterns/pattern-3/template.yaml
@@ -1481,8 +1481,10 @@ Resources:
             FunctionName: !Ref ProcessResultsFunction
         - LambdaInvokePolicy:
             FunctionName: !Ref SummarizationFunction
-        - LambdaInvokePolicy:
-            FunctionName: !Ref EvaluationFunctionArn
+        - Statement:
+            - Effect: Allow
+              Action: lambda:InvokeFunction
+              Resource: !Ref EvaluationFunctionArn
         - CloudWatchLogsFullAccess
 
   StateMachineLogGroup:
