Aws lambda not connecting with Dynamo Db

When attaching a trigger to a DynamoDb table, you will get the error as posted by OP

You need to add a policy to the IAM role generated for that lambda function.

Here is sample JSON you can use to create the policy, just replace the lambda function and stream ARNs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction",
            "Resource": "arn:aws:lambda:region:accountnumber:function:functionname"
        },
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeStream",
                "dynamodb:GetRecords",
                "dynamodb:GetShardIterator",
                "dynamodb:ListStreams"
            ],
            "Resource": "arn:aws:dynamodb:region:accountnumber:table/table-name/stream/2019-02-27T07:41:49.893"
        }
    ]
}

Once you create the policy and attach it to the role, you can then go back to DynamoDB and create a new trigger with the lambda function. If done correctly, it will create without errors.

Seems like you only need to create this role with policy AWSLambdaDynamoDBExecutionRole and attach to your lambda. You probably don't want full access as this is a read action.

When you create a lambda function, Lambda create a role by default for the lambda function created, but that role isn't enough to give permissions to Dynamo to invoke lambda functions. So in role seccion seek your lambda function and attach the AWSLambdaInvocation-DynamoDB policy.

Something I had to do was go to the IAM Management console and attach AmazonDynamoDBFullAccess to the specific role.