A company uses AWS Organizations to manage multiple accounts. Developers are refactoring apps to run as AWS Lambda functions in a VPC. The team stores shared data on an Amazon EFS file system in Account A and wants Lambda functions in Account B to mount the existing EFS access point. Company policy requires serverless deployments to be in Account B. Which combination of steps will enable Account B’s Lambda functions to access the EFS file system in Account A? (Choose three.)

To allow Lambda functions in Account B to access an EFS file system in Account A, cross-account access and network connectivity are essential. First, modify the EFS file system policy in Account A to explicitly grant Account B's IAM principals (e.g., the Lambda execution role) permissions to mount and write to the EFS file system. This ensures the necessary authorization. Second, establish a VPC peering connection between the VPC in Account A (where EFS resides) and the VPC in Account B (where Lambda functions run). This provides the required network path for the Lambda functions to reach the EFS file system. Finally, update the Lambda execution role(s) in Account B to include permissions to access the VPC and to use the EFS file system, specifically elasticfilesystem:ClientMount and elasticfilesystem:ClientWrite actions. Incorrect options: SCPs are organizational guardrails and don't grant specific resource permissions. Provisioning a new EFS in Account B and using DMS is an unnecessary and complex replication strategy when direct access is possible. Configuring Lambda functions in Account B to assume a role in Account A is not the standard or most secure way to grant cross-account EFS access; direct policy grants are preferred.