Your Lambda Has All the Right Permissions — So Why Can't It Reach DynamoDB?

A real-world VPC + Lambda DNS puzzle that'll make you double-check your security groups...