Lambda needs IAM Role to call AWS services. Execution Role is assumed by Lambda runtime, granting S3, DynamoDB, Secrets Manager, etc. access.
Policy example:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::checkout-bucket/*"
},
{
"Effect": "Allow",
"Action": ["dynamodb:PutItem"],
"Resource": "arn:aws:dynamodb:region:account:table/orders"
}
]
}