This is my CFN template:

  TestArcSchSMRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      RoleName: TestArcSchSMRole
      PermissionsBoundary: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/LZ-Bndry"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
                - states.amazonaws.com
                - ec2.amazonaws.com
                - iam.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: TestArcSchSMRole
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - arn:aws:lambda:us-east-2:${AWS::AccountId}:function:Ev-arch-schema*
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt StartProcessLambdaFunction.Arn
                  - !GetAtt LPLambdaFunction.Arn
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt LPLambdaFunction.Arn
                  - !GetAtt SpinEc2LambdaFunction.Arn
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt SpinEc2LambdaFunction.Arn
                  - !GetAtt DropSchemaLambdaFunction.Arn
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt DropSchemaLambdaFunction.Arn
                  - !GetAtt NFOPSLambdaFunction.Arn
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt NFOPSLambdaFunction.Arn
                  - !GetAtt NtOpsLambdaFunction.Arn
                  - !Sub
                    - ${functionArn}:*
                    - functionArn: !GetAtt NtOpsLambdaFunction.Arn
              - Effect: Allow
                Action: sns:Publish
                Resource:
                  - arn:aws:sns:us-east-2:${AWS::AccountId}:dev-Ev-arch-schema
              - Effect: Allow
                Action:
                  - events:PutTargets
                  - events:PutRule
                  - events:DescribeRule
                Resource:
                  - arn:aws:events:us-east-2:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - rds-data:*
                  - iam:*
                Resource: '*'

While deploying the resources using SAM deploy, the above role is throwing error:

Resource handler returned message: “The policy failed legacy parsing (Service: Iam, Status Code: 400, Request ID: d241a251-45gh-4fb9-9669-666gfbfb)” (RequestToken: 0d792418-45kndk-0904-9d0e-4kmnk4tnk4, HandlerErrorCode: InvalidRequest)

It looks like issue is with the PermissionsBoundary. Any help will be really helpful.