This is the culmination of half a days work trying to figure out why my Lambda function didn’t fire:
The console doesn’t support directly modifying permissions in a function policy. You must use either the AWS CLI or the AWS SDKs.
In other words: it is a secret setting that we hide from you. Just in case you’re trying to use a versioned lambda function or a function alias.