A company has an application workflow in which an AWS Lambda function downloads and decrypts files from Amazon S3. The files are encrypted with AWS Key Management Service (AWS KMS) keys. A solutions architect needs to ensure the correct permissions are set. Which combination of actions accomplishes this? (Choose two.)

To allow a Lambda function to decrypt KMS-encrypted S3 objects, two primary permission configurations are needed. First, the Lambda function requires an execution role with the kms:Decrypt permission. This is achieved by creating a new IAM role with this permission and attaching it to the Lambda function. Second, the KMS key itself must permit the Lambda function's IAM role to perform decryption. This is done by explicitly granting the kms:Decrypt permission to the Lambda IAM role within the KMS key's policy. Both steps are crucial: the Lambda role needs permission to request decryption, and the KMS key needs to allow that specific role to decrypt. Attaching kms:decrypt to the Lambda function's resource policy is incorrect because resource policies define permissions for other AWS services to invoke or interact with the Lambda function, not for the Lambda function itself to access other services. Granting decrypt permission for the Lambda resource policy in the KMS key's policy is also incorrect as KMS key policies grant permissions to IAM principals (users, roles), not to resource policies of other services.