A media company has a multi-account AWS environment in us-east-1. An Amazon SNS topic in a production account publishes performance metrics. A Lambda function in an administrator account must be invoked by messages from the production SNS topic when significant metrics occur. Which combination of steps will meet these requirements? (Choose two.)

To allow cross-account SNS topic publishing to a Lambda function, two main steps are required. First, the SNS topic in the production account needs a resource policy that permits the Lambda function in the administrator account to subscribe to it. This establishes the necessary cross-account permission for subscription. Second, the Lambda function itself needs an IAM resource policy (also known as a permissions policy) that grants the SNS topic permission to invoke the function. This ensures that once the Lambda is subscribed, SNS can trigger it. Incorrect options: Implementing an SQS queue to buffer messages is a valid pattern for decoupling, but it's not strictly necessary to meet the core requirement of cross-account SNS-to-Lambda invocation. Using EventBridge is a powerful integration tool, but SNS can directly invoke Lambda functions (with proper permissions), making EventBridge an unnecessary intermediary in this specific scenario. Storing metrics in S3 and using Athena is for data storage and analysis, not for real-time invocation of a Lambda function based on SNS messages.