A Config rule triggers remediation using a Systems Manager Automation document, but the runbook fails with AccessDenied on its resource changes. What should be inspected?

1. The remediation execution role, its trust and action permissions, and the runbook input configuration.
2. Only the Config rule display color.
3. Grant administrator access to every account user as the only remedy.
4. Disable compliance recording so the remediation looks successful.