A company needs to automate a daily security report. An AWS Lambda function in us-west-2 reads Amazon Inspector findings ingested into AWS Security Hub and is triggered on a schedule by Amazon EventBridge. The function is failing to generate the report. Provide a least-privilege fix. Which solution meets these requirements?

The Lambda function needs permissions to read data from both Amazon Inspector (where findings originate) and AWS Security Hub (where they are ingested). Granting read-only permissions for both services to the Lambda execution role ensures it can access all necessary information to generate the report. This adheres to the principle of least privilege by only providing the required read access. Adding a resource-based policy to the Lambda function (Option A) would grant Security Hub permission to invoke the Lambda, which is not the issue here; the Lambda needs to read from Security Hub. Attaching AWSSecurityHubReadOnlyAccess (Option B) is insufficient because the function also needs to access Inspector findings, even if they are ingested into Security Hub. A custom IAM policy (Option D) is overly specific and might miss necessary actions or resources, whereas a broader read-only policy for both services is more robust and still adheres to least privilege for this use case.