A company has multiple member accounts in an AWS Organization. The security team needs to programmatically list every Amazon EC2 security group and its inbound/outbound rules across member accounts using an AWS Lambda function that runs in the management account. Which combination of IAM/trust changes will allow the management-account Lambda to retrieve this information from member accounts? (Choose three.)

To allow the Lambda function in the management account to access resources in member accounts, a cross-account role assumption is required. First, each member account needs an IAM role with a trust policy that permits the management account's Lambda execution role to assume it. This is achieved by "Create a trust relationship that allows principals in the management account to assume specific IAM roles in each member account." Second, these roles in the member accounts must have the necessary permissions to read EC2 security group information, which the "AmazonEC2ReadOnlyAccess managed policy" provides. Finally, the Lambda execution role in the management account needs permissions to perform the sts:AssumeRole action on the ARNs of these newly created roles in the member accounts, as stated by "Create an IAM role in the management account whose policy permits sts:AssumeRole on the ARNs of the IAM roles in the member accounts." The other options describe incorrect or insufficient trust relationships or role configurations.