"Read and change all data on all websites" - is that really needed to "redirects to the Hacker News submit page with the title and the URL filled in"?
https://github.com/RhinoSecurityLabs/cloudgoat/blob/master/scenarios/vulnerable_lambda/README.md
1 IAM User
1 IAM Role
1 Lambda
1 Secret