An external security audit found that many AWS Lambda execution roles in a serverless app have overly broad IAM policies (for example, full S3 and DynamoDB access). The company wants each function to have only the minimal permissions needed. A solutions architect must determine the exact permissions each Lambda function requires with the least effort. What should the architect do?

The correct answer is to enable AWS CloudTrail and use IAM Access Analyzer to generate policies. CloudTrail records API calls made to AWS services, and IAM Access Analyzer can then process these logs to automatically generate fine-grained IAM policies based on the actual actions performed by each Lambda function. This approach minimizes effort because Access Analyzer automates the policy generation, which then only requires review and refinement. Using Amazon CodeGuru for profiling is incorrect because CodeGuru focuses on code performance and optimization, not on generating IAM policies from API calls. Writing a custom script to parse CloudTrail logs is less efficient than using IAM Access Analyzer, which is designed for this purpose. Similarly, using Amazon EMR to process CloudTrail logs is an overly complex and resource-intensive solution for this task when Access Analyzer provides a more direct and automated method.