A private application uses a VPC endpoint for S3. Requests fail due to an endpoint-policy deny even though its role allows the bucket. Which statement is correct?

1. Change the SDK response serializer to ignore the endpoint authorization result.
2. Endpoint policy is another applicable authorization layer; align it with the required role and bucket access.
3. An identity-policy allow always overrides explicit endpoint-policy denies.
4. Using a private endpoint removes the need for all IAM permissions.