A company wants OS-level and language-package vulnerability scanning integrated into its CI/CD pipeline so only images without CRITICAL or HIGH findings reach production. The pipeline is CodePipeline with CodeBuild, CodeDeploy, and an ECR repo. Which combination of steps achieves this? (Choose two.)

Amazon ECR enhanced image scanning, powered by Amazon Inspector, provides comprehensive vulnerability scanning for OS-level and programming language packages, which aligns with the requirement for detailed findings. Basic ECR scanning (Clair) is less comprehensive and might miss language-package vulnerabilities. To integrate the scan results into the CI/CD pipeline and enforce the CRITICAL/HIGH finding policy, an EventBridge rule can trigger a Lambda function upon scan completion. This Lambda can then parse the Amazon Inspector scan report, determine if the image meets the security criteria, and communicate an "Approved" or "Rejected" status back to the CI/CD pipeline (e.g., by updating a CodePipeline stage or failing a CodeBuild job). ECR does not natively send a "Rejected" status to the CI/CD pipeline based on scan findings; it only reports the scan status.