An EventBridge event is configured to invoke an AWS Lambda function, but invoking the function produces an AccessDeniedException. How should the data engineer fix this error?

An AccessDeniedException indicates a permissions issue. For EventBridge to invoke a Lambda function, two sets of permissions are crucial: 1. The IAM role used by EventBridge (often a service-linked role or a custom role) needs permission to invoke Lambda functions. 2. The Lambda function itself requires a resource-based policy that explicitly grants permission to the EventBridge service (e.g., events.amazonaws.com) to invoke it. The other options are incorrect: The trust policy of the Lambda function's execution role defines who can assume that role, not who can invoke the function. The subnet configuration for a Lambda function is related to network access, not invocation permissions. EventBridge schemas and event mapping relate to the structure and transformation of event data, not the underlying authorization to invoke a target.