A security engineer is troubleshooting an AWS Lambda function named MyLambdaFunction that fails when trying to read objects from an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The bucket has a bucket policy in place. Which change to the policy will ensure the Lambda function can read the objects?

The correct answer is to change the Resource element to arn:aws:s3:::DOC-EXAMPLE-BUCKET/. This ensures the policy grants permissions to all objects within the specified S3 bucket, which is necessary for the Lambda function to read them. The other options are incorrect because: Removing the Condition element or modifying the Principal element might affect who can access the bucket or under what conditions, but it doesn't directly address the resource the policy applies to for read operations. The Principal for a Lambda function accessing S3 would typically be the Lambda function's execution role, not the Lambda function ARN itself in the S3 bucket policy. Updating the Action element might be necessary if the current action doesn't include s3:GetObject, but the question implies the issue is with which resources the action applies to, not the action itself. Changing the Resource element to arn:aws:lambda:::function:MyLambdaFunction is incorrect because the S3 bucket policy defines permissions for resources within S3, not for Lambda functions.