A company uses AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect must ensure the correct permissions are in place so the environment variables can be decrypted and used. Which steps must the solutions architect take to implement the required permissions? (Choose two.)

To decrypt Lambda environment variables, the Lambda function's execution role needs permission to use the KMS key. This is achieved by adding the necessary KMS decryption actions (e.g., kms:Decrypt) to the Lambda execution role's IAM policy. Additionally, the KMS key policy itself must explicitly allow this Lambda execution role to perform those decryption actions. Both steps are crucial: the role needs permission, and the key needs to grant that permission to the role. Adding KMS permissions in the Lambda resource policy or function policy is incorrect because Lambda execution permissions are managed via the execution role. Allowing the Lambda resource policy in the KMS key policy is incorrect as KMS key policies grant permissions to IAM principals (like roles), not resource policies.