EC2 instances in private subnets do not appear as Systems Manager managed nodes. The SSM Agent is installed and running. They have no internet egress. Which checks most directly address the missing prerequisites? Select 2 answers.

1. Open inbound TCP port 22 from the internet because SSM Agent requires an incoming SSH session.
2. Verify that the instance profile grants the Systems Manager permissions required for managed instances.
3. Verify DNS and HTTPS connectivity to the required Systems Manager service endpoints, using correctly configured interface endpoints for the Region.
4. Create only an S3 gateway endpoint and assume it provides all SSM Agent control-channel connectivity.
5. Grant the required permissions only to the EC2 role trust policy, without an instance permission policy.