A CloudFormation template was used to create an EventBridge rule that targets an AWS Lambda function. The Lambda is intended to log event details to CloudWatch Logs and has permissions to write logs. However, the Lambda is not being invoked by the rule. What change to the CloudFormation stack will fix this?

The correct answer is to add an AWS::Lambda::Permission resource that grants events.amazonaws.com permission to invoke the Lambda function. This is because EventBridge (formerly CloudWatch Events) requires explicit resource-based permissions on the target Lambda function to be able to invoke it. The AWS::Lambda::Permission resource defines these permissions, specifying events.amazonaws.com as the principal allowed to perform the lambda:InvokeFunction action. Adding an AWS::IAM::Role for EventBridge is incorrect because EventBridge doesn't assume a role to invoke a Lambda; it needs direct permission on the Lambda itself. Adding an AWS::IAM::Role for Lambda execution permissions is also incorrect as the problem states the Lambda already has permissions to write logs, implying its execution role is set up, but this role doesn't grant external services permission to invoke it. Granting lambda.amazonaws.com permission is incorrect because events.amazonaws.com is the correct service principal for EventBridge.