你如何授予iot:DescribeEndpoint权限给lambda ？

【以下的问题经过翻译处理】 如何将一个操作添加到默认的Lambda角色中？

        const p = new iam.ServicePrincipal('lambda.amazonaws.com');
        const role = new iam.Role(this, "someExecRoleID", {
                roleName: "someExecRole",
                assumedBy: p
            });
        role.grant(p, "iot:DescribeEndpoint");

        const serviceLambda = new nodejs.NodejsFunction(this, "WashnetEndpoints", {
                /* stuff deleted */
                handler: "getMqttEndpoint",
                role: role,
            }
        );

下面的错误，是因为我使用了lambda.amazonaws.com的service principal吗？

"AccessDeniedException: User: arn:aws:sts::312345678:assumed-role/blah is not authorized to perform: iot:DescribeEndpoint because no identity-based policy allows the iot:DescribeEndpoint action",