An AWS Lambda function was misused to modify data. A security engineer needs to identify who invoked the function and what it returned. However, there are no logs from the function in Amazon CloudWatch Logs. Which explanation accounts for the missing logs?

The correct answer is that the Lambda function’s execution role does not include permissions to write logs to CloudWatch Logs. For a Lambda function to send logs to CloudWatch Logs, its execution role must have the necessary IAM permissions, such as logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Without these permissions, the function cannot create log groups or streams, nor can it write log events, resulting in a lack of logs. The other options are incorrect: Invoking a function through Amazon API Gateway does not prevent logs from being stored in CloudWatch Logs; API Gateway itself can also generate logs there. CloudWatch Logs is a dedicated logging service and does not store logs directly in an Amazon S3 bucket for Lambda function logs; it manages its own storage. An outdated version of the Lambda function would still attempt to write logs if its execution role had the correct permissions.