Exam AWS Certified Security - Specialty topic 1 question 418 discussion

A company has application logs from AWS accounts in an organization in AWS Organizations. A security engineer is copying these logs to a centralized Amazon S3 bucket in the security team’s AWS account.

Each of the company’s applications is in its own AWS account. Logs are encrypted and pushed into S3 buckets that are associated with each account.

The security engineer deploys an AWS Lambda function into each account to copy the relevant log files to the centralized S3 bucket. The Lambda function can copy the log files in the centralized S3 bucket.

The Lambda function’s IAM execution role policy from the security team’s AWS account is the following:



The centralized S3 bucket policy is the following:



The security engineer needs to remove excess permissions while ensuring the functionality of the solution.

Which changes to the policies meet these requirements? (Choose two.)