I deployed a Lambda function, opened the Monitor tab to watch it work, and got a red error box instead of logs — a failed StartQuery, because the log group it wanted to query didn't exist. The obvious conclusion is that the execution role can't write logs, so I spent a while auditing a role that turned out to be fine.

Two separate things were going on. The missing log group wasn't a symptom of anything: CloudWatch creates it on the first invocation, and nobody had invoked the function yet. But the role did have a problem, just not the one the missing group pointed at — and not one that was ever going to appear in CloudWatch, because it killed the function before a line of my code ran. A permissions boundary was quietly capping the role, and the policy I kept re-reading was never going to show me that.