To ensure secure and least privilege access for the API Gateway to invoke Lambda functions, you should create an IAM role with the minimum required permissions for the API Gateway to invoke the specific Lambda functions and assign it to the API Gateway. This approach follows the principle of least privilege by granting the API Gateway access only to the Lambda functions it needs to invoke. Option C is incorrect because the Lambda function's execution role is separate from the API Gateway's permissions. Options A and D are not recommended as they involve using excessive permissions or the root account, which can lead to security risks.