A Lambda function is triggered by S3 events and must run whenever a specific bucket has new or modified objects. The function reads the S3 bucket name and object key from the event to fetch the object's contents, parse them, and write the results to a DynamoDB table. The function's execution role has permissions to read the bucket and write to DynamoDB, but during testing the function does not run when objects are added or modified. What will fix this issue?

The correct solution is to add a resource-based policy to the Lambda function. For S3 to invoke a Lambda function, the function's permissions policy must explicitly grant S3 permission to do so. Without this policy, S3 lacks the authorization to trigger the function, even if the function's execution role has the necessary permissions to interact with S3 and DynamoDB. Increasing memory or /tmp space addresses performance or temporary storage issues during execution, not invocation failures. Configuring an SQS queue as an OnFailure destination handles errors after the function is invoked, not preventing the initial invocation problem.