I think the documentation should give the precise AWS permissions so that a role can be issued. Currently it only reads "# the role must have access to AWS Lambda".