Multiple IAM roles per function

Yes my first stab at it was a bit of a fumble but I did eventually end up with something nearly identical to what you suggested. Unfortunately then I ran into another issue:

Policy creation works ... but does it?