An application retrieves a Systems Manager Parameter Store SecureString encrypted with a customer managed key. Which access is required to obtain the plaintext through the supported API?

1. Only kms:GenerateDataKey without parameter-read or decrypt permissions.
2. Only possession of the parameter name, because SecureString values are public once named.
3. Only permission to list EC2 instance names.
4. The required parameter-read permission and KMS decrypt authorization, with decryption requested appropriately.