Which combination of steps will ensure that only the Lambda function's execution role can access a Secrets Manager secret encrypted with KMS, following least-privilege principles? (Choose two.)

To ensure least privilege, you must use a customer-managed key (CMK) for Secrets Manager. The default AWS-managed key for Secrets Manager is shared across accounts and cannot be restricted to a specific Lambda role. Creating a CMK allows you to define a key policy that explicitly grants kms:Decrypt permission to only the Lambda function's execution role. This CMK must also trust Secrets Manager (via its service principal) to allow Secrets Manager to use the key. The Lambda function's execution role then needs an IAM policy granting kms:Decrypt on this specific CMK. Granting decrypt to the account root principal is overly permissive and violates least privilege. Removing all KMS permissions would prevent the Lambda function from decrypting the secret.