5-lambda-invoke-role.ts

private createOutputLambdaInvokeRole(
    outputLambda: lambda.Function
): iam.Role {
    const name = 'OutputLambdaAppSyncInvokeRole';
    const invokeRole = new iam.Role(this, name, {
        roleName: name,
        assumedBy: new iam.ServicePrincipal('appsync.amazonaws.com')
    });
    
    invokeRole.attachInlinePolicy(this.createOutputLambdaInvokePolicy(outputLambda));

    return invokeRole;
}

private createOutputLambdaInvokePolicy(
    outputLambda: lambda.Function
): iam.Policy {
    const name = 'OutputLambdaAppSyncInvokePolicy';

    return new iam.Policy(this, name, {
        policyName: name,
        statements: [new iam.PolicyStatement({
            effect: iam.Effect.ALLOW,
            actions: [ 'lambda:InvokeFunction' ],
            resources: [ outputLambda.functionArn ]
        })]
    });
}