A DevOps engineer wrote an IAM policy used by a Lambda function that stops EC2 instances tagged Environment: NonProduction on weekends. The policy was flagged as overly permissive. Which changes should the engineer make to follow least privilege? (Select three.)

The correct answer addresses least privilege by restricting the policy's scope. Changing "Resource": "" to "Resource": "arn:aws:ec2:::instance/" limits the policy's effect to only EC2 instances, rather than all AWS resources. This is a fundamental principle of least privilege, ensuring the Lambda function can only act on the specific resource type it's designed to manage. Changing "Action": "ec2:" to "Action": "ec2:StopInstances" is also correct. It restricts the allowed actions to only StopInstances, preventing the Lambda function from performing other EC2 operations like starting, terminating, or modifying instances. Adding a conditional expression to check for the "Environment: NonProduction" tag is also correct. This ensures the policy only applies to instances with the specified tag, further narrowing the scope and preventing unintended actions on production or untagged instances. Other options that suggest adding conditional expressions without specifying the correct condition are incomplete or vague and do not fully address the overly permissive nature of the original policy.