Correct Answer: Create a resource-based policy on the Lambda function that allows lambda:InvokeFunction and uses Service: events.amazonaws.com as the principal.

Explanation:
When Amazon EventBridge needs to invoke a Lambda function, the proper way to authorize this interaction is by attaching a resource-based policy to the Lambda function. This policy should explicitly grant lambda:InvokeFunction permission and restrict the principal to events.amazonaws.com, which is the invoking service. This ensures least privilege by allowing only the specific action and principal.

Why the other options are incorrect:

Granting lambda:InvokeFunction to * is too broad and violates least privilege by allowing any entity to invoke the function.
Adding permission to the Lambda execution role is ineffective because execution roles define what the function can do, not who can invoke it.
Granting lambda:* in a resource policy is overly permissive and unnecessary for this use case.

Full AWS Practitioner Certification Question