Use a user with only LambdaInvoke rights.