A company requires security approval before any application changes are deployed to production using AWS CodePipeline, and the approval must be recorded and retained. Which combination of actions satisfies these requirements? (Choose two.)

To meet the requirement for security approval before deployment, a CodePipeline manual approval action is necessary. This action pauses the pipeline, awaiting explicit approval. Granting the security team an IAM policy with permissions to approve manual approval stages ensures only authorized personnel can proceed with deployments. For recording and retaining these approvals, AWS CloudTrail is the appropriate service. CloudTrail logs API calls and events made within your AWS account, including the approval or rejection of manual approval actions in CodePipeline. Delivering these CloudTrail logs to an S3 bucket provides a durable and auditable record of all approval activities, satisfying the retention requirement. Configuring CodePipeline to write actions to CloudWatch Logs or S3 at the end of each stage would provide pipeline execution details but not specifically the approval event itself in an auditable format. Creating a custom action with Lambda for approval is an alternative for complex approval workflows but doesn't inherently provide the audit trail; CloudTrail is still needed for that.