EventBridge matches a rule, but its Lambda target receives no invocations because invocation permission is missing. Which permission is normally relevant?

1. A Lambda resource policy allowing the EventBridge service to invoke the function, appropriately scoped to the rule.
2. Public S3 read permission on the Lambda deployment artifact.
3. Only permission for the rule creator to view the Lambda console.
4. Only events:PutEvents in the Lambda execution role.