When can you change the execution role of a Lambda?
never
only at creation
anytime via configuration
only before deployment