A company is moving from on-premises CI/CD to AWS. They want their packages and dependent public repositories available in CodeArtifact with minimal operational overhead. Which combination of steps should they take? (Choose two.)

The first correct option, using AWS IAM Roles Anywhere, allows on-premises CI/CD pipelines to securely assume an IAM role with permissions to publish packages to CodeArtifact without managing long-lived AWS credentials. This minimizes operational overhead and enhances security. The second correct option, creating CodeArtifact repositories with external connections to public repositories and setting them as upstream dependencies, efficiently handles public dependencies. CodeArtifact will automatically fetch and cache packages from these public repositories on first request, making them available to your builds without manual intervention. The incorrect option involving VM images and AWS Import/Export is overly complex for publishing packages and doesn't align with modern CI/CD practices. The S3 bucket and Lambda trigger option adds unnecessary layers of abstraction and operational overhead compared to direct publishing via Roles Anywhere. The final incorrect option, configuring multiple external connections as downstream of a single repository, misuses the upstream/downstream relationship; external connections should be upstream to fetch packages.