An EventBridge rule matches the expected events in testing. Its Lambda target receives no invocations, and the rule reports FailedInvocations. The function works when invoked manually. Which permission should the engineer check first?

1. Grant events:PutEvents on the event bus to the Lambda function resource policy.
2. The Lambda execution role must allow events:PutEvents on every event bus.
3. Grant lambda:InvokeFunction only to the IAM user who created the rule.
4. The Lambda resource policy must allow events.amazonaws.com to invoke the function, scoped to the rule ARN.