A company deploys AWS Lambda functions with AWS CloudFormation. Developers are trying to debug a deployed function, but it is not writing output to Amazon CloudWatch Logs. Which combination of actions should a security engineer take to resolve this? (Choose two.)

For a Lambda function to write logs to CloudWatch, two primary conditions must be met. First, the Lambda execution role must have a trust policy that allows the Lambda service (represented by the service principal lambda.amazonaws.com) to assume the role. This is fundamental for the Lambda service to operate on behalf of your function. Second, the Lambda execution role must possess the necessary IAM permissions to perform logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions in CloudWatch Logs. Without these permissions, the function cannot create log groups or streams, nor can it write log events. Incorrect options: X-Ray tracing is for distributed tracing and performance monitoring, not for enabling basic CloudWatch logging. Lambda functions do not use resource policies to grant themselves permissions to write to CloudWatch Logs; they use their execution role. Resource policies are typically used for granting other services or accounts access to the Lambda function itself. The role developers use for debugging is separate from the Lambda execution role. While developer permissions are important for deploying and managing the function, they do not directly affect the function's ability to write logs once invoked.