AWS Lambda not being invoked by other Lambda

I have created a custom AWS authentication flow based on the following Github Repo

I want the verify-auth-challenge-response Lambda to invoke a custom Lambda i have created which I am using to set the user's password. This is in a scenario where the user didn't have a verified email address. I don't want them to have to complete a verification code twice so want this new Lambda to set the password if the challenge is accepted.

I have modified the verify-auth-challenge-response as follows

import { VerifyAuthChallengeResponseTriggerHandler } from 'aws-lambda';
import AWS from 'aws-sdk';

export const handler: VerifyAuthChallengeResponseTriggerHandler = async (event, context) => {
    const expectedAnswer = event.request.privateChallengeParameters!.secretLoginCode; 
    if (event.request.challengeAnswer === expectedAnswer) {
        event.response.answerCorrect = true;
        changePassword(context);
    } else {
        event.response.answerCorrect = false;
    }
    return event;
};

//@ts-ignore
const changePassword = async (context) => {
    const lambda = new AWS.Lambda({
        region: 'eu-west-2'
      });
    const params = {
        FunctionName: 'CustomLambdaName', // the lambda function we are going to invoke
        InvocationType: 'Event',
        LogType: 'Tail',
        Payload: '{ "password" : "PasswordSuppliedByUser" }'
    }
    lambda.invoke(params, function(err, data) {
        if (err){
             console.log(err, err.stack);
             context.done('error', err);
            } // an error occurred
        else     {
            console.log(data);
            context.succeed(data.Payload);
        }       // successful response
      });
}

I added my custom Lambda to the projects template.yaml under Resources:

  ChangePassword:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda-triggers/change-password/
      Handler: change-password.handler
      Runtime: nodejs12.x

After deployment I created an IAM role which has these policies

AWSLambdaExecute
AWSLambdaBasicExecutionRole
AWSLambdaRole

and assigned the role manually to verify-auth-challenge-response and change-password lambdas.

When verify-auth-challenge-response executes, it returns OK and the console logs I added show it passes over the invoke call. However my change-password lambda has never been invoked. Any idea how I can debug why it is not being invoked? I am wondering if its related to async behaviour in the Lambda.

Thanks!