Giving Firehose the following two permissions worked for me:
"lambda:InvokeFunction", "lambda:GetFunctionConfiguration"