A Glue job role has s3:GetObject permission for its input prefix. Reads fail with AccessDenied because the objects use a customer managed KMS key. No explicit denies apply. Which authorization checks are required? Select 2 answers.

1. Make the input bucket public because public S3 access bypasses KMS authorization.
2. Grant only s3:ListBucket and assume listing permission also decrypts object contents.
3. Verify that the KMS key policy or an applicable grant permits the role or enables the required IAM authorization path.
4. Verify that the job role has the required kms:Decrypt permission for the key used by the objects.
5. Grant kms:GenerateDataKey only and assume it replaces decrypt permission for existing input objects.