title: AWS STS temporary credentials InvokeFunction lambda not working
body: <p>I'm issuing an STS token for a user interface that includes the following statement for lambda permissions:</p>
  
  <pre><code>   {
       "Sid" : "AllowUserInvokeLambda",
       "Action": [
          "lambda:InvokeAsync",
          "lambda:InvokeFunction"
       ],
       "Effect": "Allow",
       "Resource": [
           "arn:aws:lambda:us-east-2:*:function:CreateThumbnail",
           "arn:aws:lambda:us-east-2:*:function:ImageScanner"
       ]
     },
  </code></pre>
  
  <p>When I try to invoke the function from the aws-sdk.js in the browser, I get back an error with the message:</p>
  
  <pre><code>"User: arn:aws:sts::123456789012:assumed-role/test_sts_role/user-12345 is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-east-2:198765432109:function:ImageScanner"
  </code></pre>
  
  <p>Am I missing something in that policy?</p>