A service in account A must assume a restricted role in account B. Which permissions form the normal cross-account assumption path? Select 2 answers.

1. The caller is authorized to invoke sts:AssumeRole on the target role, with applicable policy boundaries satisfied.
2. Share account B root credentials with the caller instead of assuming a role.
3. The target role trust policy permits the authorized principal from account A.
4. Put the target role permissions in a description field instead of a policy.
5. Only grant s3:GetObject in account A and omit all STS and role trust configuration.