Operations has a tested Systems Manager Automation runbook that restarts a failed service and verifies recovery. A CloudWatch alarm must trigger this procedure automatically. The workflow needs a durable execution record and permission to perform only the remediation steps. Which combination meets the requirement? Select 2 answers.

1. Create an SNS email subscription and assume receipt of the email restarts the service automatically.
2. Route the alarm state-change event through EventBridge to start the Automation runbook with the affected resource as input.
3. Configure the runbook to use the application instance role even though that role lacks permission to perform the remediation steps.
4. Use narrowly scoped permissions for the EventBridge target invocation and the Automation execution role.
5. Run the procedure only on a nightly schedule and leave the alarm disconnected from the procedure.