A developer created a Lambda function that sends an Amazon SNS notification when an S3 object larger than 50 MB is uploaded. The function was tested via the CLI and worked. After adding an S3 event notification to the bucket, uploading a 3,000 MB file does not trigger the Lambda. Which of the following could explain why the Lambda function is not being invoked?

The correct answer is that the Lambda function's resource-based policy does not include the necessary permissions for Amazon S3 to invoke it. When an AWS service like S3 needs to invoke a Lambda function, the function's resource-based policy must explicitly grant permission to that service. Testing via the CLI bypasses this requirement because the CLI user's credentials are used to invoke the function directly, not S3. S3 event notifications do not have a size limit of 1,000 MB; they work for objects of any size. Lambda functions can absolutely be invoked from S3 events, which is a common pattern. Finally, an S3 bucket does not need to be public for event notifications to work; private buckets frequently use this feature.