An EC2 application role can call s3:GetObject on an object but receives AccessDenied when downloading it. The object uses SSE-KMS with a customer managed key, and no explicit denies apply. Which authorization checks are necessary? Select 2 answers.

1. Grant kms:GenerateDataKey only and assume it is sufficient for decrypting an existing object.
2. Verify that the role has the required kms:Decrypt permission for the key.
3. Make the bucket public because public S3 access bypasses KMS key authorization.
4. Verify that the KMS key policy or a grant permits the role, or enables the applicable IAM authorization path.
5. Replace the role trust policy with an allow for s3:ListAllMyBuckets to authorize KMS decryption.