Check IAM permissions of caller in AWS Lambda

Question

I have dozens of services each requiring access to their corresponding secret in AWS Secrets Manager. I have implemented a solution of granular permissions to IAM roles of services so that each can access only their credentials. This creates neatly a least access pattern to services.

I want to implement an AWS Lambda to abstract away access to Secrets Manager secrets. If I have only one Lambda (per environment), how can I check that the IAM role invoking the lambda has permissions to access a particular secret? So to exclude the case of a service requesting access to another service's credentials.

I can always create one lambda per service and assign permissions to each service to only invoke their lambda (which only accesses the corresponding secret), but this seems quite inelegant...