Amplify: Lambda@Edge for Next CloudFront + DynamoDB permissions problem

I am deploying a Next.js app to Amplify with the amplify-cli. I've connected my amplify app to a couple of existing (created with terraform) DynamoDB tables. I've managed to modify the attached amplify app's Service role adding in the AmazonDynamoDBFullAccess permission policy (I'll restrict it down later). I would've thought this would work, but it does not propagate down to the created API Lambda@Edge for Next CloudFront distribution or Default Lambda@Edge for Next CloudFront distribution

I can see logs showing permission errors from these lambdas.

arn:aws:sts::999999999:assumed-role/rgsuvm9-psuzoeg/us-east-1.ggvvff-abc123 is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:eu-west-2:6666666666:table/MyTable

I noticed these roles that have been automatically created with generated names for AWS Service: lambda trusted entitees that have policies attached for allowing access to logs and S3 only.

Here is an example of one of the attached permission policies for these generated roles (this is before I have manually edited it to add dynamodb access permission):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ]
        },
        {
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::z0kq2lk-i0l0usx/*",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ]
        }
    ]
}

Manually selecting one of these and adding dynamodb read/write permissions fixes the problem and the SSR edge lambda seems to have the correct permissions to connect to the dynamodb - great, but this isn't a nice way to do it

My question is: How to change the permissions of the SSR Lambda? It's not a feasible or a good solution for me to manually add these permissions to this role that's clearly generated.

It seems odd to me that it doesn't use the service role that's assigned in the amplify app's general settings. Could that be a problem with amplify - or have I misconfigured the service role? (my service role used uses the AdministratorAccess-Amplify and AmazonDynamoDBFullAccess policies so to my mind there's no point pasting these in).