A healthcare company is developing an AWS Lambda function that publishes notifications containing protected health information (PHI) to an encrypted Amazon SNS topic. The SNS topic uses AWS KMS customer managed keys for encryption. The company must ensure the application has the necessary permissions to publish messages securely to the SNS topic. Which combination of steps will meet these requirements? (Choose three.)

To publish to an encrypted SNS topic using a customer managed key (CMK), three permission sets are required. First, the Lambda function's execution role needs IAM permissions to perform kms:Decrypt and kms:GenerateDataKey actions on the CMK. This allows the Lambda function to interact with the encryption key. Second, the CMK's key policy must explicitly grant the Lambda execution role permission to use the key for encryption and decryption operations. This ensures the key itself permits access. Third, the SNS topic's resource policy must allow the Lambda function's execution role to publish messages to the topic. Incorrect options: Using SSE-KMS instead of CMKs would change the encryption method, not solve the permission issue for CMKs. Specifying the Lambda function's ARN in the SNS topic's resource policy is part of the correct step of creating a resource policy, but it's not a standalone step that covers all requirements. Associating an API Gateway HTTP API is irrelevant as the Lambda function directly publishes to SNS, not through an API Gateway.