A custom AWS Config rule uses a Lambda function to check Amazon ECR repository policies for any statements allowing ecr:* actions. When a noncompliant repository is found, EventBridge routes the notification via SNS to a security team. The Lambda function fails to run during rule evaluations. What change fixes the problem?

The Lambda function is failing to run, indicating an issue with how AWS Config interacts with the function. For AWS Config to invoke a Lambda function as part of a custom rule, the Lambda function's resource-based policy must explicitly grant permission to the AWS Config service principal (config.amazonaws.com) to invoke it. Without this permission, AWS Config cannot trigger the function. Modifying the SNS topic policy is incorrect because the problem is with the Lambda execution, not the notification delivery. Adding permissions to the Lambda execution role is also incorrect; the execution role defines what the Lambda function can do, not what can invoke it. Modifying ECR repository policies is irrelevant to the Lambda function's ability to be invoked by AWS Config.