Which combination of steps will meet these requirements?
(Choose three.)
Deploy the Lambda function to the project account. Update the Lambda function’s IAM role with the directconnect:* permission.
Create a cross-account IAM role in the shared services account that grants the Lambda function the directconnect:* permission. Add the sts:AssumeRole permission to the IAM role that is associated with the Lambda function in the shared services account.
Add a custom resource to the CloudFormation networking stack that references the Lambda function in the project account.
Deploy the Lambda function that is performing the association to the shared services account. Update the Lambda function’s IAM role with the directconnect:* permission.
Create a cross-account IAM role in the shared services account that grants the sts:AssumeRole permission to the Lambda function with the directconnect:* permission acting as a resource. Add the sts:AssumeRole permission with this cross-account IAM role as a resource to the IAM role that belongs to the Lambda function in the project account.
Add a custom resource to the CloudFormation networking stack that references the Lambda function in the shared services account.