A serverless application (one Lambda function and one S3 bucket) is being deployed with AWS SAM. The Lambda function only needs read access to the S3 bucket. How should the SAM template grant the function the required read permission?

The correct approach is to add the S3ReadPolicy managed policy template to the Lambda function's execution role. AWS SAM provides managed policy templates like S3ReadPolicy that simplify granting common permissions. By attaching this policy to the Lambda function's execution role, the function automatically receives the necessary permissions to read objects from any S3 bucket. Referencing a second Lambda authorizer function is for API Gateway authorization, not for granting S3 access to a Lambda function. Attaching a custom S3 bucket policy directly to the Lambda function is incorrect; bucket policies are attached to the S3 bucket itself to control access to its objects. Creating an Amazon SQS topic is irrelevant for granting S3 read permissions to a Lambda function.