A central pipeline deploys into a separate production account. Encrypted artifacts are in the tool account S3 bucket. Deployment fails when the production action accesses the artifact. Which design should be verified?

1. Share the tool account root key with every production action.
2. Use an artifact tag saying trusted and omit all bucket and key permissions.
3. Grant the production role only permission to list the tool account users.
4. Configure the deployment role trust and permissions plus the artifact bucket and customer managed KMS key access for the cross-account path.