title: InvalidLambdaFunctionAssociation when creating CloudFront distribution via Terraform
body: <p>I want to create a CloudFront distribution that could invoke a <code>lambda</code> (@edge). I was able to do that using AWS console. I am now trying to achieve the same using Terraform. My configurations are as follows.</p>
  
  <p>First, I created a role for lambda.</p>
  
  <pre><code>resource "aws_iam_role" "my_edge_lambda_iam_role" {
    name = "my_edge_lambda_iam_role"
  
    assume_role_policy = &lt;&lt;EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  EOF
  }
  </code></pre>
  
  <p>Next, I created a the lambda.</p>
  
  <pre><code>resource "aws_lambda_function" "redirect_lambda" {
    filename         = "myscript.js.zip"
    function_name    = "my_js_script"
    role             = "arn:aws:iam::123456789:role/my_edge_lambda_iam_role"
    handler          = "index.handler"
    runtime          = "nodejs4.3-edge"
  }
  </code></pre>
  
  <p>Finally, I (attempted to) created the CloudFront distribution using the ARN of the lambda function above. The definition is as follows.</p>
  
  <pre><code>resource "aws_cloudfront_distribution" "s3_distribution" {
    origin {
      domain_name = "my-bucket.s3.amazonaws.com"
      origin_id   = "&lt;my S3 path&gt;"
    }
  
    enabled             = true
    is_ipv6_enabled     = true
  
    default_cache_behavior {
      allowed_methods  = ["GET", "HEAD"]
      cached_methods   = ["GET", "HEAD"]
      target_origin_id = "&lt;my target origin&gt;"
  
      forwarded_values {
        query_string = false
  
        cookies {
          forward = "none"
        }
      }
  
      lambda_function_association {
        event_type = "viewer-request"
        lambda_arn = "&lt;arn of the lambda function denerated above&gt;"
      }
  
      viewer_protocol_policy = "allow-all"
      min_ttl                = 0
      default_ttl            = 86400
      max_ttl                = 31536000
    }
  
    price_class = "PriceClass_All"
  
    viewer_certificate {
      cloudfront_default_certificate = true
   }
  
    restrictions {
      geo_restriction {
        restriction_type = "none"
      }
    }
  }
  </code></pre>
  
  <p>When trying to create the distribution, I get the following exception.</p>
  
  <pre><code>Error applying plan:
  
  1 error(s) occurred:
  
  * aws_cloudfront_distribution.s3_distribution: 1 error(s) occurred:
  
  * aws_cloudfront_distribution.s3_distribution: InvalidLambdaFunctionAssociation: Failed to retrieve the function from Lambda. ErrorCode: AccessDeniedException Function: arn:aws:lambda:us-east-2:12345678:function:my_js_script
      status code: 400, request id: 65579sd33-3f2d5-181e7-9140-79c1ff79fbdd
  </code></pre>
  
  <p>Could it be a problem with how I have defined the role?</p>