由于您是从应用程序调用Lambda函数，因此需要添加权限为此，在IAM中。
您的流程看起来不错，只需确保您正在调用 GetOpenIdTokenForDeveloperIdentity 从您的Lambda函数。您可能要研究这个项目以供参考。

Since you are calling Lambda function from the app, you need to add permission for that in IAM. Your flow looks good, just make sure you are calling GetOpenIdTokenForDeveloperIdentity from your Lambda function. You might want to look into this project for references.